Validation Troubleshooting Print

The Validation Troubleshooting section is designed to help you resolve the most common "hang-ups" that occur after youve activated your SSL but before it has been issued.

If your certificate status has been stuck on "Pending" for more than two hours, one of the following issues is likely the cause.

Troubleshooting SSL Validation

1. I didn't receive the Approval Email

If you chose Email Validation, the Certificate Authority (CA) sends a specific code to a pre-selected address.

• Check the address: Remember, you can only use generic addresses like admin@, webmaster@, or postmaster@.

• Check Spam/Junk: These automated emails are frequently flagged by filters.

• Whitelist the Sender: Ensure your mail server isn't blocking mail from @sectigo.com or @comodoca.com.

• Resend the Email: You can trigger a resend via your Nixzoehost Dashboard under the SSL management tab.

2. DNS CNAME Record Not Found

If you chose DNS Validation, the CAs "bott" must be able to see a specific CNAME record in your DNS settings.

• Check for Typos: Ensure the "Host" and "Value" match exactly what is provided in your dashboard.

• DNS Propagation: DNS changes can take 30 minutes to 4 hours to update globally. The CA won't see the record until it propagates.

• Nameserver Conflict: If your domain is pointed to Cloudflare or a third-party host, you must add the CNAME record there, not in the Nixzoehost dashboard.

3. HTTP File Upload is Failing (403 or 404 Errors)

If you chose the File Upload method, the CA must be able to reach a specific .txt file on your server.

• The Path is Critical: The file must be located at yourdomain.com/.well-known/pki-validation/. Note the dot before "well-known."

• Permission Denied (403): Ensure the folder and the file have the correct permissions (usually 755 for folders and 644 for files).

• HTTPS vs HTTP: If your site already has an old/expired SSL, the CA might try to reach the file via https://. Ensure the file is accessible via both versions.

• Firewall Blocks: Some security plugins (like Wordfence or Sucuri) or server firewalls (ModSecurity) block requests to hidden folders like .well-known. Temporarily disable these if the validation fails.

4. The "Brand Validation" Delay

Sometimes, an order is held for manual review by the Certificate Authority. This is known as Brand Validation.

• Why it happens: Your domain name contains a "high-profile" keyword (like "Google," "Bank," "Amazon," or "Facebook") or a trademarked term.

• The Solution: This requires a human at the CA (Sectigo/Digicert) to verify you aren't phishing. This can add 2448 hours to the process. Nixzoehost cannot speed this up, as it is a legal safety check.

5. CAA Record Conflicts

A CAA (Certificate Authority Authorization) record is a DNS entry that tells the world which CAs are allowed to issue certificates for your domain.

• The Problem: If you have a CAA record that only lists "Let's Encrypt," but you are trying to install a "Sectigo" SSL, the validation will fail.

• The Fix: Either delete the CAA record or add a new one that authorizes your chosen CA.

How to Check Your Status

If you want to see exactly where your certificate is in the process, you can use the Sectigo Order Status Tracker. You will need your Order ID and the administrative email address used during activation.