Fix Netlify SSL Certificate Provisioning Failures
Netlify automatically attempts certificate issuance, so a persistent provisioning failure usually points to domain validation, DNS propagation, conflicting routes, or certificate authorization rather than a missing manual certificate purchase.
Open Domain management → HTTPS and identify the exact Netlify error. For external DNS, Netlify currently documents one apex A record to 75.2.60.5 and a www CNAME to your site’s `[sitename].netlify.app` hostname. Remove extra A and AAAA records, verify that the authoritative DNS has propagated everywhere, check DNSSEC, and allow Let’s Encrypt in CAA. Netlify says failure beyond the first 24 hours likely needs DNS investigation.
This guide diagnoses Netlify certificate failures through the selected DNS method, exact apex and www routing, authoritative propagation, duplicate A or leftover AAAA records, DNSSEC, CAA, certificate retry behavior, aliases, and final HTTPS redirects. It distinguishes a certificate problem from an SPA route or failed deployment.
Quick Questions
Netlify currently retries frequently during the first 24 hours and less frequently afterward, but says a certificate missing after 24 hours likely indicates DNS misconfiguration.
Netlify’s current SSL troubleshooting guidance identifies leftover AAAA records as a certificate blocker and instructs users to remove them for this setup.
Yes. A restrictive CAA policy that does not permit Let’s Encrypt can prevent Netlify from provisioning its certificate.
Netlify certificate failure evidence map
- No working netlify.app deploy: repair the deployment first
- External DNS apex differs from the current Netlify value: correct routing
- www points elsewhere: fix or remove the alias
- Multiple A or any leftover AAAA records: remove the conflicting route
- DNS correct everywhere but issuance fails: review DNSSEC and CAA
- HTTPS works but refresh returns 404: fix SPA routing separately
See which AI crawlers actually reach your website.
Track visits from GPTBot, ClaudeBot, PerplexityBot, search bots, and other discovery agents-then see which public pages attract their attention.
- Monitor leading AI and search crawlers
- Review which public pages receive visits
- Connect crawler activity to your visibility work
Main Explanation
Read the exact message in Domain management → HTTPS. Waiting on DNS propagation, DNS verification failed, domain not served by Netlify, and a failed Let’s Encrypt authorization point to related but different evidence. Confirm the production deploy works on its netlify.app hostname before changing DNS. A failed build or missing publish directory is not repaired by a certificate retry.
Determine whether the site uses Netlify DNS or external DNS. With Netlify DNS, the registrar must delegate to the nameservers assigned by Netlify. With external DNS, Netlify’s current guide documents an apex A record to 75.2.60.5 and a site-specific www CNAME ending in netlify.app. Do not combine both methods casually; verify which nameservers are authoritative.
Inspect apex and www independently. The apex can route correctly while www still points to an old host, or the inverse. A certificate may need to cover every domain alias attached to the site. Remove aliases that are not ready, or configure each attached hostname correctly. Preserve unrelated email and verification records while cleaning only website-routing conflicts.
Remove duplicate A and leftover AAAA records when using the documented external-DNS path. Netlify explains that multiple apex A records or IPv6 routes can send validation requests away from its infrastructure. This can appear intermittent because different resolvers, networks, or clients choose different answers. One consistent public route is required before certificate issuance can be reliable.
Check propagation with authoritative and multiple recursive resolvers. A provider dashboard only proves what was entered, not what the public internet receives. Netlify states that the correct records must propagate globally before provisioning can complete. If authoritative DNS is wrong, correct it. If authoritative DNS is right but old recursive answers remain, wait for their TTL instead of repeatedly changing the record.
Review DNSSEC when the records appear correct but validation fails. Netlify’s current troubleshooting page notes that Netlify DNS does not support DNSSEC and recommends identifying conflicts with DNSViz. DNSSEC is a zone-wide trust control, so verify the delegation and signatures before disabling anything. A broken chain can make an otherwise correct record unresolvable.
Inspect CAA next. CAA limits which certificate authorities can issue. Netlify uses Let’s Encrypt for this flow, so an effective CAA policy that excludes letsencrypt.org can block provisioning. If no CAA exists, there may be nothing to add. If it exists, permit the documented issuer or remove the restriction according to the organization’s certificate policy.
After the certificate appears, enforce the preferred HTTPS host and test apex, www, aliases, assets, and deep links. A React route that returns Page Not Found on refresh is an SPA rewrite problem, not an SSL problem. Update canonicals, sitemap URLs, and Search Console, then scan the live site with TruboRankAI for crawl, routing, content, AEO, GEO, and AI-discovery gaps.
Practical Steps
- Confirm the Netlify deployment works.
- Read the exact HTTPS status.
- Identify Netlify DNS versus external DNS.
- Verify apex, www, and every attached alias.
- Remove extra A and AAAA routes.
- Check authoritative and global propagation.
- Review DNSSEC and CAA authorization.
- Test HTTPS redirects and audit the final site.
Stop guessing whether AI crawlers see your best pages.
Use crawler activity as an early discovery signal, identify pages that receive attention, and find important pages that may need a clearer path.
- Monitor leading AI and search crawlers
- Review which public pages receive visits
- Connect crawler activity to your visibility work
Turn AI crawler visits into a repeatable visibility workflow.
Monitor discovery over time, compare activity across important pages, and use the evidence to decide what deserves attention next.
- Monitor leading AI and search crawlers
- Review which public pages receive visits
- Connect crawler activity to your visibility work
FAQ
Should I keep clicking Provision certificate?
Repeated retries do not repair incorrect DNS, DNSSEC, or CAA. Fix the documented blocker and let Netlify retry its normal process.
Why does Netlify need www configured if I use the apex?
If www is attached as an alias or redirect target, it must resolve consistently so validation and visitor redirects work. Remove unused aliases or configure them.
Is Netlify Page Not Found on refresh an SSL issue?
No. When HTTPS and the homepage work but a deep SPA route fails on refresh, diagnose redirects or rewrites separately.
Sources and methodology
The guide follows Netlify’s official certificate retry, external DNS, propagation, DNSSEC, and CAA troubleshooting sequence reviewed on 2026-08-16. It labels private provisioning state separately from public evidence and does not promise search performance after recovery.
These references support the changeable facts and study findings discussed above. Results depend on each source's sample, date, market, query set, and measurement method.