# \[Support Guide\] SSL / TLS Certificate Provisioning **URL:** \ **Category:** Support Guides\ **Tags:** support-guide, netlify-dns-https-ssl\ **Created:** [June 5, 2019, 5:05pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300 "2019-06-05T17:05:21Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![futuregerald](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/futuregerald/32/33_2.png) [@futuregerald](https://answers.netlify.com/u/futuregerald)\ **Post date:** [June 5, 2019, 5:05pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/1 "2019-06-05T17:05:21Z")
_Last reviewed & updated by Netlify Support in July 2025_ Dealing with [SSL/TLS (Secure Sockets Layer/ Transport Layer Security)](https://www.websecurity.digicert.com/security-topics/what-is-ssl-tls-https) can be a tricky subject, but at Netlify, we try and make it as easy as possible to get an SSL certificate set up. However, there are times when this process doesn’t work as smoothly as we’d like, and there are a couple of reasons why that could be which we’ll explore in this article. Generally, the reason we are unable to provide a complete SSL certificate for your custom domain is that the [DNS](https://www.cloudflare.com/learning/dns/what-is-dns/) (Domain Name System) cache timeout aka [TTL (Time To Live)](https://www.cloudflare.com/learning/cdn/glossary/time-to-live-ttl//) for a record had not had time to expire from your old settings before you tried to use it with Netlify. [Let’s Encrypt, our SSL provider](https://letsencrypt.org) is unable to create certificates for names that have old cached values still in effect. When you add a custom domain to your site we’ll attempt to get you a certificate immediately. If that fails, we will retry every 10 minutes for the first 24 hours after you assign the name to a site, then once every hour during the following two days. This means that the vast majority of the time we will get you a certificate if you wait a short while. If you don’t get a certificate that first day then the problem is usually the case that your DNS for the domain is not setup properly, and if that’s the case we recommend reading through our [docs on custom domains and DNS.](https://docs.netlify.com/domains-https/custom-domains/#dns-configuration). We’ve also got another more conversational write-up of best DNS practices that you may find more accessible, written by one of our Support Engineers: [How to Set Up Netlify DNS - Custom Domains, CNAME, & Records](https://www.netlify.com/blog/2020/03/26/how-to-set-up-netlify-dns-custom-domains-cname-a-records/) You should also see some basic tips on setting up your DNS right on the Domain Settings page for your site, on [app.netlify.com](http://app.netlify.com). If the provisioning process generates a partial certificate, you can try using the “Renew certificate” button at the bottom of the site’s DNS settings page. If that fails too, we can still help you - feel free to respond to this post, and we’ll help you to get things fixed up. [Let’s Encrypt’s rate limits](https://letsencrypt.org/docs/rate-limits/) can be finicky to work with, but sometimes a little extra time can allow things to work right when we request or renew the certificate. Let us know if you have trouble with DNS or SSL, we’re happy to help! ---
**Author:** ![chrisdjbell](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/chrisdjbell/32/1175_2.png) [@chrisdjbell](https://answers.netlify.com/u/chrisdjbell)\ **Post date:** [June 10, 2019, 1:55pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/2 "2019-06-10T13:55:07Z")
Can we issue more than one cert per site? I’ve seen lets encrypt has a 100 domain per cert limit so if I have more than 100 alternate domain names can I issue a second cert? We offer whitelabel domains for our agency users so we have 133 subdomains at the moment but thats increasing ---
**Author:** ![fool](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/fool/32/37_2.png) [@fool](https://answers.netlify.com/u/fool)\ **Post date:** [June 11, 2019, 10:55pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/3 "2019-06-11T22:55:04Z")
Nope! Max one certificate per site on our service. The reason you might have less than one per site is if you follow my advice below. You can of course create multiple sites with the same codebase! Then you can put a bunch of names on the same codebase. The best workflow for “many subdomains” is of course to use a wildcard certificate to cover them all. If you don’t do this all certificate operations (e.g. adding a name) will be QUITE slow since lets encrypt essentially processes them one at a time and each one takes a few seconds, so you might consider less hostnames per site (\<=20 is a good benchmark, since that is also a lets encrypt rate limit and since we ask for name1, then name1+name2, then name1+name2+name3+… as you add the names in our UI. LE has a limit of 20 requests per week for any name, so you can see that we’ll hit that weekly limit at 20 names. ---
**Author:** ![scotttrinh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/scotttrinh/32/5458_2.png) [@scotttrinh](https://answers.netlify.com/u/scotttrinh)\ **Post date:** [January 6, 2020, 7:19pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/10 "2020-01-06T19:19:20Z")
I have a site currently being hosted with Cloudflare pointing at Cloudfront/S3 and I want to switch over to Netlify. I’ve switched my staging environment, but noticed that there is a delay between switching the DNS record on Cloudflare to point to Netlify and disabling the proxying and when a certificate is able to be generated with Let’s Encrypt automatically. Is there a best practices way to do this switch to minimize downtime and user-facing issues? ---
**Author:** ![laura](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/laura/32/6274_2.png) [@laura](https://answers.netlify.com/u/laura)\ **Post date:** [January 8, 2020, 9:41pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/11 "2020-01-08T21:41:37Z")
Hi @scotttrinh! Welcome to netlify community. The only way I know of to minimize downtime is covered in this post: [[Support Guide] Minimal downtime for a live site DNS migration](https://answers.netlify.com/t/common-issue-minimal-downtime-for-a-live-site-dns-migration/141) Does that help? ---
**Author:** ![itshaisam](https://avatars.discourse-cdn.com/v4/letter/i/958977/32.png) [@itshaisam](https://answers.netlify.com/u/itshaisam)\ **Post date:** [May 24, 2020, 6:12pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/21 "2020-05-24T18:12:14Z")
Hi! I provided custom domain for my netlify account and i also provided SSL certifcate . but when it try to visit my website by custom link i provided in some browsers it is showing page is not secure. I would really appreciate if somebody can guide me whats the problem. this is my domain ‘[itshaisam.com](http://itshaisam.com)’, and this is netlify link ’ keen-panini-6e3ea7.netlify.app’ . But when it type full path like [https://itshaisam.com](https://itshaisam.com) then its fine, but in some browser when i simply type [itshaisam.com](http://itshaisam.com) when page is loaded it says page not secure. Thanks… ---
**Author:** ![luke](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/luke/32/39_2.png) [@luke](https://answers.netlify.com/u/luke)\ **Post date:** [May 26, 2020, 9:58am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/22 "2020-05-26T09:58:57Z")
Hi, @itshaisam, and welcome to the Netlify community site. 👍 In order to troubleshoot, we need to track down what is happening when your browser makes that request. We need the more information about the request in order to do that. The simplest way to do this is to send us the `x-nf-request-id` header which we send with every HTTP response. There more information about this header here: > [@\[Support Guide\] Netlify Support asked for the 'x-nf-request-id' header? What is it and how do I find it?](https://answers.netlify.com/t/common-issue-netlify-support-asked-for-the-x-nf-request-id-header-why-are-they-asking-for-it-and-how-do-i-find-it/4385): > > Last reviewed by Netlify Support in July 2025 What is the x-nf-request-id header? Web servers and web browsers communicate using a protocol called HTTP - which stands for “HyperText Transfer Protocol”. Both web browsers and web servers use a feature called headers as part of this protocol. The headers that web browsers send are called “request headers” because the browser in making an “HTTP request”. The web servers headers are called “response headers” because web servers send an “HTTP respo… If that header isn’t available for any reason, please send the information it replaces (or as many of these details as possible). Those details are: - the complete URL requested - the IP address for the system making the request - the IP address for the CDN node that responded - the day of the request - the time of the request - the timezone the time is in Now, if SSL negotiation is failing, then it is almost certain you won’t receive any headers so the details above are remaining option. We look forward to researching this in more detail and please free feel to add additional questions anytime. ---
**Author:** ![mrcportillo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/mrcportillo/32/24202_2.png) [@mrcportillo](https://answers.netlify.com/u/mrcportillo)\ **Post date:** [May 5, 2022, 6:10pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/38 "2022-05-05T18:10:13Z")
Hello, I have been trying to renew a certificate for the last two weeks, the actual one is still valid, but the reason for me to request a renewal is that it expires the day before an event that will have massive traffic on the site and I would like to reduce the risk and have that certificate with a further expiration date. Is there a way to debug the update process and see why it’s not working? ---
**Author:** ![hrishikesh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hrishikesh/32/74607_2.png) [@hrishikesh](https://answers.netlify.com/u/hrishikesh)\ **Post date:** [May 8, 2022, 1:58pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/39 "2022-05-08T13:58:42Z")
Could we know the site in question? ---
**Author:** ![mrcportillo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/mrcportillo/32/24202_2.png) [@mrcportillo](https://answers.netlify.com/u/mrcportillo)\ **Post date:** [May 9, 2022, 12:57pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/40 "2022-05-09T12:57:34Z")
Sure, the netlify project’s name is boss-site. The domain that we’re trying to renew certificates to is [https://buttercup.boss.splunk.com](https://buttercup.boss.splunk.com/) ---
**Author:** ![perry](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/perry/32/16_2.png) [@perry](https://answers.netlify.com/u/perry)\ **Post date:** [May 9, 2022, 3:42pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/41 "2022-05-09T15:42:22Z")
hi there, just to be sure, you tried the “renew certificate” button in the netlify UI, right? if not, please do, and if you did, let us know what happened? ---
**Author:** ![mrcportillo](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/mrcportillo/32/24202_2.png) [@mrcportillo](https://answers.netlify.com/u/mrcportillo)\ **Post date:** [May 9, 2022, 4:05pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/42 "2022-05-09T16:05:47Z")
Hi, yes I have tried that multiple times over the last two weeks. It just opens the modal and after clicking on “renew certificate” disappears, the date remains the same though. ---
**Author:** ![luke](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/luke/32/39_2.png) [@luke](https://answers.netlify.com/u/luke)\ **Post date:** [May 10, 2022, 12:03am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/43 "2022-05-10T00:03:22Z")
Hi, @mrcportillo. You cannot renew the certificate because our service will only do so if at least one of the two requirements below is met: - The list of domain names the SSL certificate covers does not include all domain names listed on the site. - If the SSL certificate will expire in 30 days or less. The first requirement is obvious. If you change the domain names configured for a site, the SSL certificate needs to be updated to include the new names. The second requirement is a Let’s Encrypt recommended best practice. The SSL certificates they issue always expire in 90 days and they recommend renewing them 30 days before they expire. Looking at this site’s SSL certificate neither requirement is met. The certificate covers all the domain names on the site and it isn’t less than 30 days before it expires. The SSL certificate will expire on June 12th. This means that the renewal will process on May 13th (which may be the 14th for you depending on your timezone). That renewal will be automatic and you won’t need to click anything. Also, if the renewal fails, we will email you to let you know. Because we renew 30 days before it expires, we will then still have 30 days to troubleshoot. If there are other questions about this, please let us know. ---
**Author:** ![system](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/system/32/13_2.png) [@system](https://answers.netlify.com/u/system)\ **Post date:** [September 12, 2022, 2:23pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/45 "2022-09-12T14:23:37Z")
Automatically bumped on September 12, 2022, 2:23pm UTC ---
**Author:** ![SimonWMX](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/simonwmx/32/23695_2.png) [@SimonWMX](https://answers.netlify.com/u/SimonWMX)\ **Post date:** [October 8, 2022, 7:10am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/46 "2022-10-08T07:10:54Z")
Hello, Trying to activate SSL/HTTPS on a Netlify hosted website but the process seems to be stuck, nothings happen. Already waited for more than 48h, and still nothing. I don’t have any “renew certificated” button since I am not using Netlify’s DNS. I prefer not using them since my customer is also using e-mails with his domain. I have the feeling that if I stop the process and restart it, it’s going to work. Can anybody help me ? I can give you the URL of the website in private message, it is the latest website I hosted on my account. Thanks a lot for your help ! ---
**Author:** ![coelmay](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/coelmay/32/24427_2.png) [@coelmay](https://answers.netlify.com/u/coelmay)\ **Post date:** [October 8, 2022, 7:35am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/47 "2022-10-08T07:35:33Z")
Hey @SimonWMX What is the domain you are having issues with? ---
**Author:** ![SimonWMX](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/simonwmx/32/23695_2.png) [@SimonWMX](https://answers.netlify.com/u/SimonWMX)\ **Post date:** [October 8, 2022, 8:28am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/48 "2022-10-08T08:28:47Z")
Hi @coelmay Just checked, and now the SSL is working ! Don’t know if you did something ? Or if it was my attempts from this morning (deleted DNS zone, and created it again). Anyway, it works now 🙂 Thanks ! ---
**Author:** ![Doist](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/doist/32/42741_2.png) [@Doist](https://answers.netlify.com/u/Doist)\ **Post date:** [November 5, 2022, 9:46am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/49 "2022-11-05T09:46:50Z")
Hey folks 🙂 I’m having trouble with the “doist-typist.netlify.app” site, the Let’s Encrypt certificate is taking _forever_ to be generated. Clicking “Retry DNS verification” returns “DNS verification was successful”, so I’m assuming everything is set up correctly. Is there anything I can do (or that you can do) to speed things up? Kind regards, Ricardo (Frontend Engineer @ Doist) ---
**Author:** ![hrishikesh](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/hrishikesh/32/74607_2.png) [@hrishikesh](https://answers.netlify.com/u/hrishikesh)\ **Post date:** [November 6, 2022, 12:09pm UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/50 "2022-11-06T12:09:45Z")
Your DNS setting seem to have blocked Lets Encrypt: ```auto dig CAA +short doist.dev 0 iodef "mailto:artyom@doist.com" 0 issue "amazon.com" ``` Either remove those or add Lets Encrypt to the list. ---
**Author:** ![Doist](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/doist/32/42741_2.png) [@Doist](https://answers.netlify.com/u/Doist)\ **Post date:** [November 7, 2022, 8:58am UTC](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300/51 "2022-11-07T08:58:42Z")
Thank you, I’ll look into that. [Next page](https://answers.netlify.com/t/support-guide-ssl-tls-certificate-provisioning/1300.md?page=2)