Custom certificates stuck at “Awaiting certificates” despite correct DNS and ownership TXT

Questions / Help
1

Hi,

I’m migrating a Django/Wagtail application from Nexcess to Fly.io and I’m unable to get custom certificates issued for my domains.

App:

  • nicklee

Domains:

Current status

The Fly dashboard says:

“DNS is configured. Certificates are being issued.”

However, the certificates remain stuck in “Awaiting certificates”.

DNS

DNS is hosted on Cloudflare.

For troubleshooting all website records are currently set to DNS only (proxy disabled).

Current DNS:

A nicklee.co.uk 66.241.125.122
AAAA nicklee.co.uk 2a09:8280:1::13a:edaf:0

CNAME www ********.nicklee.fly.dev

TXT _fly-ownership ********
TXT _fly-ownership.www ********

fly certs check --json

The output appears internally inconsistent.

The required DNS records are:

A:
66.241.125.122

AAAA:
2a09:8280:1::13a:edaf:0

Fly can also see exactly those records:

dns_records.a:
66.241.125.122

dns_records.aaaa:
2a09:8280:1::13a:edaf:0

Ownership TXT is detected:

“ownership_txt_configured”: true

ALPN is detected:

“alpn_configured”: true

However Fly still reports:

“dns_configured”: false

and

“status”: “Awaiting certificates”

Connectivity tests

The application itself is healthy.

curl -I https://nicklee.fly.dev

returns HTTP/2 200.

HTTP for the custom domain reaches Fly:

curl -I http://nicklee.co.uk

returns:

HTTP/1.1 301 Moved Permanently
Server: Fly

However HTTPS on the custom domain fails because no certificate appears to be attached.

openssl s_client -connect 66.241.125.122:443 -servername nicklee.co.uk

returns:

no peer certificate available

Things I’ve already tried

  • Verified A/AAAA records.
  • Verified ownership TXT records.
  • Removed and recreated both certificates.
  • Disabled Cloudflare proxy (DNS only).
  • Confirmed Cloudflare nameservers are active.
  • Removed force_https and redeployed.
  • Confirmed the app has both the shared IPv4 and dedicated IPv6 addresses attached.
  • Confirmed the application works correctly at https://nicklee.fly.dev.

Has anyone seen dns_configured remain false even though dns_records exactly match dns_requirements?

Is there anything else I should check, or does this look like the certificate provisioning process is stuck?

Thanks!

4

DNS records are public, there is no point censoring them here.

I see your domain pointing to Cloudflare:

nixie:~$ dig +short nicklee.co.uk
104.21.38.40
172.67.218.195
nixie:~$ dig +short nicklee.co.uk aaaa
2606:4700:3037::6815:2628
2606:4700:3031::ac43:dac3

is the orange cloud enabled on the cloudflare dashboard?

also see Understanding Cloudflare · Fly Docs

5

Hi @lillian,

Thanks for the help, I have since enabled the cloudflare proxy in an effort to push the site live using flexible SSL in cloudflare whilst waiting for the fly.io certificate to sort itself out.

Previously I had the proxy/orange tick disabled, but fly.io still was stuck on issuing certificate.

6

@lillian now created an SSL certificate in Cloudflare, imported it into Fly, switched back to full ssl in cloudflare and it’s working.

Thanks again!