Fastly TLS Certificate Stuck Pending or Not Provisioning

How to fix it

Try these in order — the most common fix is first.

1. 1. Fix the challenge DNS record

   Copy steps
   1. Check with dig _acme-challenge.www.example.com +short (DNS challenge) or dig www.example.com +short (HTTP challenge)
   2. Create the CNAME shown on the Complete DNS verification page and keep it in place after setup
   3. For the HTTP challenge, disable any forced HTTPS redirect first; it does not work for wildcards
   Did this fix it? Yes No

2. 2. Allow the CA in your CAA records

   Copy steps
   1. List your CAA records
   2. Add or allow certainly.com, letsencrypt.org or globalsign.com depending on the CA you chose
   3. Remove CAA entries that exclude it
   Did this fix it? Yes No

3. 3. Retry or wait

   Copy steps
   1. Provisioning should take up to about an hour; wait before acting
   2. Open the subscription and click Retry now (Fastly retries for 24 hours; a subscription is marked Failed after 7 days)
   3. If stuck at Certificate requested for over an hour, contact Fastly Support
   Did this fix it? Yes No

Symptoms

TLS subscription stays at 'Checking domain DNS records' or 'Certificate requested', or ends as Failed.

Why it happens

• The _acme-challenge CNAME (DNS challenge) or the traffic CNAME/A record (HTTP challenge) is missing or wrong
• A CAA record blocks the certificate authority
• Recent DNS changes have not propagated (up to 72 hours)
• A forced HTTPS redirect blocks the HTTP challenge
• Temporary CA issue at the Certificate requested step

This guide also covers

• fastly tls certificate pending
• fastly certificate not provisioning
• fastly checking domain dns records
• fastly managed tls failed

Other Fastly errors

• Fastly Error: Unknown Domain
• Fastly 503 Backend Read Error / Connection Timeout
• Fastly Purge Not Working (Old Content Still Served)
• Fastly Origin TLS Errors: Hostname Mismatch, Unable to Verify Certificate
• Fastly Not Caching: Always X-Cache MISS
• Fastly Serves Wrong Content or Denies Requests From Origin (Override Host)
• How to Cancel Fastly Account