Every domain you connect gets an HTTPS certificate from us, free, issued and renewed automatically. You never upload one. When the Certificate column on your site's Domains tab does not say Certificate issued, this page explains why.
Why it happens
We can only issue a certificate for a domain that already points at us. The certificate authority (Let's Encrypt) checks that before it signs anything:
- On our nameservers, we prove control through our own DNS.
- Pointed at us by address (your DNS stays elsewhere,
@andwwwpoint at our address), the certificate authority fetches a file from your domain, so the domain must reach our server.
So almost every certificate problem is really a DNS problem: the domain does not point at us yet, or no longer does.
Fix it
Open Sites → your site → Domains and read the Certificate column. Extra domains show the same states as the main one. When something needs attention, the reason is written under the state.
"Certificate on its way"
"It's issued automatically the moment YOUR_DOMAIN points at us." Nothing is wrong yet: the domain is still waiting for DNS. Finish pointing it at us; see My domain doesn't open my site. Once we see it, the tab says issuing the certificate and putting the domain live. This takes a few minutes.
"No certificate yet" (DNS column: "certificate failed")
The domain pointed at us, but issuing failed. The notice reads We couldn't issue the certificate for YOUR_DOMAIN yet, with the error from the last attempt underneath. We try again every hour, spaced out on purpose: the certificate authority only allows a few failed attempts per name, and retrying at once would use them up. The domain stays connected meanwhile.
If a domain fails 6 times in a row, we email the site's owners and admins, with the error and what to check. For the main domain that email comes once. For each further domain on the site, it comes once per run of failures: after the certificate is issued, or after the domain stopped pointing at us, a new run of failures is told about again. You get it while domain notices are on under Account → Email.
Check, cheapest first:
- Nameservers. Both nameservers at your registrar must be ours. A leftover old one means some checks land at your old provider and fail.
- Pointed by address? Both
@andwwwshould point at the address shown on the Domains tab. Open the domain's Point it at us by address section (What we see ›): each row should show Reaches veldhost under Our check. Ifwwwdoes not reach us, we issue the certificate for the bare domain only, and addwwwby ourselves once it reaches us. - A CAA record. This is a general DNS rule, not something veldhost sets: a
CAArecord lists the authorities allowed to issue certificates for the domain, and any other authority must refuse. If your domain has one, it must includeletsencrypt.org(the authority we use), or remove it. - A proxy or firewall in front (for domains pointed by address): it must let requests for
/.well-known/through to us.
You do not need to press anything after fixing it: the next automatic attempt picks it up.
"Certificate will not renew"
The domain was live, but it no longer points at our nameservers (or, pointed by address, has not reached our server since the date shown). Renewal validates the same way issuing did, so it cannot succeed. Point the domain back at us before the certificate expires, or visitors get a browser warning. If you moved the domain away on purpose, the certificate is now your new host's job.
"Certificate renewal overdue"
The certificate should have renewed by now and has not. "We have been alerted — nothing is needed from you unless the domain has moved." If it has moved, see the state above.
"Managed on the server"
The domain was served before the portal managed it, so its certificate is renewed on the server directly. Nothing for you to do.
Still stuck?
The error text under We couldn't issue the certificate is what to send us. Contact us with the domain name and that line.