My certificate renewal is failing

Support
1

Hi there:

My certificate renewal is failing because it’s trying to issue a wildcard cert via DNS-01, but I am using external DNS. Please remove the wildcard requirement (.creativetravelandtours.com) and issue a standard single-domain certificate for creativetravelandtours.com and www.creativetravelandtours.com.

I asked the chatbot assistant and I got the following

Wildcard Certificate Renewal Issue

This is a known issue when using external DNS with Netlify — wildcard certificates require DNS-01 challenge validation, which needs control over the DNS zone, and this can fail when Cloudflare or another external provider manages DNS.

Unfortunately, removing the wildcard and switching to a standard certificate is not something you can do yourself from the dashboard — it requires Netlify Support to intervene on the backend.

Here’s what you should do:

1. Post in the Netlify Support Forums (or contact Support directly)

Request that Netlify:

  • Remove the wildcard (*.creativetravelandtours.com) from your certificate
  • Re-issue a standard Let’s Encrypt certificate covering only:
    • creativetravelandtours.com
    • www.creativetravelandtours.com

2. Verify your external DNS records are correct (Confirmed)

While waiting, confirm your DNS is properly configured:

  • Apex domain (creativetravelandtours.com): A record → 75.2.60.5
  • www subdomain: CNAME → [sitename].netlify.app

3. Check for a stale Netlify DNS zone

If you previously enabled Netlify DNS and still have an inactive DNS zone alongside your external DNS setup, this can conflict with certificate provisioning. If such a zone exists, it should be deleted.

4. Use Let’s Debug for diagnostics

Run your domain through letsdebug.net to identify any specific blockers (e.g., CAA records, AAAA records, multiple A records). [Troubleshoot SSL]

Note: If Let’s Encrypt has already rate-limited your domain due to too many failed authorizations, you may need to wait before a new certificate can be issued. Netlify Support can help navigate this. [SSL Error Guide]

2

Hi @jasonbek,

Thanks for reaching out and welcome to the Netlify Support Forums!

I see that you have a Netlify DNS Zone configured:

Since you’re using an external DNS configuration:

host creativetravelandtours.com
creativetravelandtours.com has address 75.2.60.5

host www.creativetravelandtours.com
www.creativetravelandtours.com is an alias for creativetravelandtours.netlify.app.
creativetravelandtours.netlify.app has address 98.84.224.111
creativetravelandtours.netlify.app has address 18.208.88.157
creativetravelandtours.netlify.app has IPv6 address 2600:1f18:16e:df01::258
creativetravelandtours.netlify.app has IPv6 address 2600:1f18:16e:df01::259

You’ll want to remove the Netlify DNS Zone here.

That should allow the SSL Certificate to get renewed.

Let us know if you continue to have issues.