# New Certificate Requirements

**URL:** <https://community.fly.io/t/new-certificate-requirements/27702>\
**Category:** Questions / Help\
**Tags:** certificates\
**Created:** [April 24, 2026, 6:33pm UTC](https://community.fly.io/t/new-certificate-requirements/27702 "2026-04-24T18:33:20Z")\
**Posts on this page:** 1\
**Showing post:** 3

<div class="post-metadata">

**Author:** ![flyio-support](https://sea1.discourse-cdn.com/fly1/user_avatar/community.fly.io/flyio-support/32/46245_2.png) [@flyio-support](https://community.fly.io/u/flyio-support)\
**Post date:** [April 24, 2026, 7:55pm UTC](https://community.fly.io/t/new-certificate-requirements/27702/3 "2026-04-24T19:55:00Z")

</div>

Hi!

Requiring an AAAA record was actually introduced at least as far back as July2025: [Generating certificates behind CDNs](https://community.fly.io/t/generating-certificates-behind-cdns/25362)

However, this was in turn superseded by an easier process where you add a single \_fly-ownership record in February 2026:

> [@Easier certs behind Cloudflare, BYO certs, and other goodies](https://community.fly.io/t/easier-certs-behind-cloudflare-byo-certs-and-other-goodies/27146):
>
> We’ve shipped some big improvements to how [certificates](https://fly.io/docs/networking/custom-domain/) work on [Fly.io](http://Fly.io). There’s a new way to verify domain ownership that sidesteps IPv6 issues behind CDNs like Cloudflare, alongside the ability to import your own certificates. Plus, certificate changes now propagate to all edges immediately, and we have new endpoints for managing certificates through the Machines API. The \_fly-ownership TXT record When you add a certificate to your app, we need to verify two things: that Let’s Encrypt can issu…

Crucially though:

the AAAA setup still works, so if you had that set up (an ipv6 address added to your app, a single AAAA record added on Cloudflare, NO A records) it will continue to work. Note this is not in addition to: the AAAA record

The old setup you describe with A record and/or CNAME caused no end of trouble when behind Cloudflare so it’s not recommended anymore.

A domain in “issuing” will continue to retry but it’s likely the failure is due to a misconfiguration, so it’s not likely to succeed unless you fix the issue. Happy to look if you let us know what the domain is, or you can run fly certs setup to get the new records to add, and if you do so, it should issue by itself in a few minutes.

Regards,

Daniel

---

_[View the full topic](https://community.fly.io/t/new-certificate-requirements/27702)._