Skip to main content

Primary Domain SSL Step Is Stuck

Written by Matt Gray

When you activate a wildcard Primary Domain, the SSL step asks you to add a CNAME record named _acme-challenge. This record lets Servd create SSL certificates for your domain and its wildcard subdomains. The step normally turns green within a few minutes of the record being added. If it stays pending, work through the checks below.

Check the CNAME Record Is Correct

Look up the record using a tool like whatsmydns.net, replacing example.com with your domain, or from the command line:

dig +short CNAME _acme-challenge.example.com

The result should exactly match the value shown in the SSL Pending popup. Common problems include:

  • The domain has been added twice. Many DNS providers automatically append your domain to the record name. If you entered _acme-challenge.example.com as the name, the record may have been created as _acme-challenge.example.com.example.com. Enter just _acme-challenge instead.

  • The value has been modified. Some DNS providers append your domain to the record value too e.g. example.com.d4afb87ca7f278e5.dcv.cloudflare.com.example.com
    Adding a . to the end of the value usually prevents this.

  • The value is incomplete. Copy the value directly from the SSL Pending popup rather than retyping it.

Remove Old _acme-challenge TXT Records

If SSL certificates for your domain were previously issued using DNS validation (by a previous host, a Let's Encrypt client, or a CDN), you may have TXT records named _acme-challenge left over. These conflict with the CNAME record and need to be deleted.

If one of your subdomains is hosted elsewhere and still relies on these records, see Disabling Wildcard Support.

Check Your CAA Records

CAA records control which certificate authorities are allowed to issue certificates for your domain. If your domain has CAA records, they must permit the certificate authorities we use. Either remove your CAA records entirely or add the following:

example.com. CAA 0 issue "letsencrypt.org"
example.com. CAA 0 issue "pki.goog"
example.com. CAA 0 issue "ssl.com"

If you also have issuewild CAA records, they control wildcard certificates, so add the same values as issuewild entries too.

If Your DNS Is Hosted On Cloudflare

If your domain's nameservers are Cloudflare's (they'll end in .ns.cloudflare.com), your Cloudflare zone may be serving its own _acme-challenge TXT records. Cloudflare creates these automatically for its Universal SSL certificates or for previous certificate orders, and they often don't appear in your DNS records list.

Cloudflare's nameservers can return these hidden records alongside, or instead of, the CNAME you've added. The certificate authority then can't reliably see the validation values we've placed, so the SSL step fails.

Signs that this is happening:

  • DNS lookup tools show TXT records under _acme-challenge even though you only added a CNAME

  • Repeated lookups return different results

To confirm, run the following, replacing example.com with your domain and <your nameserver> with one of your Cloudflare nameservers:

# 1. Get the CNAME target
dig +short CNAME _acme-challenge.example.com# 2. Get the validation values we've placed (usually two: one for the domain, one for the wildcard)
dig +short TXT # 3. See what your nameservers actually return (run this a few times)
dig +short TXT _acme-challenge.example.com @

If step 3 ever returns values that aren't in the results of step 2, or ever leaves one of them out, your zone has conflicting records.

To fix it, open your domain in the Cloudflare dashboard and:

  1. Go to DNS > Records and delete any TXT records named _acme-challenge. Leave the CNAME record in place.

  2. Go to SSL/TLS > Edge Certificates and delete any pending or unused certificates.

  3. If none of your DNS records are proxied (orange-clouded), you can also disable Universal SSL on the same page. Caution: Any proxied records will lose their Cloudflare SSL certificate if you do this. If you're moving a proxied domain to Servd, see Migrating A Cloudflare Proxied Domain first.

  4. Repeat the check above. If the extra TXT values are still present, they can't be removed from the dashboard.

Last Resort: Publish the Validation Values Directly

If you've already pointed your domain's DNS at Servd before the Ownership and SSL steps have turned green, and visitors are now seeing SSL errors, you may not be able to wait for Cloudflare Support to remove the hidden _acme-challenge records described above. In that case, you can get a certificate issued by publishing our validation values directly as TXT records.

Warning: This is a temporary workaround, not a fix. It stops your certificate from renewing automatically, and your site will show SSL errors again when the certificate expires unless you take further action. Only use it if you've confirmed the Cloudflare issue above and can't wait for it to be resolved.

  1. Find the current validation values by looking up the TXT records at the CNAME target:

dig +short CNAME _acme-challenge.example.com
dig +short TXT # There will usually be two values: one for your domain and one for its wildcard subdomains.
# If no values are returned, get in touch with our support team before going any further.

2. In the Cloudflare dashboard, go to DNS > Records and add a TXT record named _acme-challenge for each value.

3. Click the Refresh button next to your domain on your project's Domains page. Once the SSL step turns green, your certificate has been issued.

SSL certificates last 90 days and are renewed during the final 30 days before they expire. Every renewal uses new validation values, which we place at the CNAME target. While this workaround is in place, the certificate authority only sees the old values you added, so the renewal will fail.

To keep your site working long-term, you'll need to:

  • Remove the TXT records you manually added before.

  • Get the hidden records removed by Cloudflare.

  • Make sure the _acme-challenge CNAME record is still in place.

Refresh The Domain

Once you've made changes, click the Refresh button next to your domain on your project's Domains page. Changes can take a few minutes to be picked up, depending on your DNS provider and the TTL of your records.

If the SSL step is still pending after working through these checks, get in touch with our support team and include the domain name you're trying to activate.

Did this answer your question?