Fly.io Certificate Not Issuing or Custom Domain Not Working

How to fix it

Try these in order — the most common fix is first.

1. 1. Check and fix DNS

   Copy steps
   1. Run fly certs add example.com, then fly certs setup example.com
   2. Run fly certs check example.com
   3. Use either A and AAAA, or one CNAME for subdomains
   Did this fix it? Yes No

2. 2. Behind Cloudflare

   Copy steps
   1. Add a _fly-ownership TXT record
   2. Set SSL mode to Full or Full (strict); Flexible causes redirect loops
   3. If HTTP-01 stays blocked, use fly certs import with a Cloudflare Origin Certificate
   Did this fix it? Yes No

3. 3. If you hit rate limits

   1. Wait for the Let's Encrypt window to pass; Fly cannot reset it
   Did this fix it? Yes No

Symptoms

fly certs show reports pending, the cert never issues, or the domain loops with redirects behind Cloudflare.

Why it happens

• Mixed CNAME and A/AAAA records
• Missing AAAA, _acme-challenge CNAME or _fly-ownership TXT record
• Let's Encrypt rate limits (50 certs per domain per week, 5 failed validations per hostname per hour)
• Cloudflare orange cloud with Flexible SSL

This guide also covers

• fly.io certificate pending
• fly certs check
• fly.io custom domain not working
• fly.io cloudflare 520

Other Fly.io errors

• Fly.io: The app is not listening on the expected address and will not be reachable by fly-proxy
• Fly.io 502 Bad Gateway
• Fly.io 503 Service Unavailable
• Fly.io Health Checks Failing
• Fly.io Machines Stopping or Not Starting (Auto-Stop)
• Fly.io Out of Memory (OOM Killed)
• Fly.io Deploy Failed: Waiting for Depot Builder, Registry 401, Too Many Requests
• How to Cancel Fly.io: Delete an App, Stop Billing and Delete Your Account