SSL _acme-challenge records present in DNS but still Pending Validation (TXT)

[sandro]

That’s all right, because Origin certificates are only trusted by Cloudflare.

Is the domain generally active on Cloudflare? Can you post a screenshot of the Overview screen?

[adsense-ar]

Yup, the site is working fine in CF…without enc, so yes, maybe there’s some issue in CF and the edge cert creation

[sandro]

Next steps should be

• Change the encryption mode to Full Strict
• Disable Universal SSL

[adsense-ar]

• Change the encryption mode to Full Strict (done)
• Disable Universal SSL (you mean Enable right?)

[sandro]

I mean disable

Once it’s disabled, post a full page screenshot of https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates

[adsense-ar]

Done

[sandro]

All right, no certificates listed. Wait at least half an hour and then enable Universal SSL again. Should it still not issue the certificate, then I am afraid the community cannot help any more and you will have to open a ticket at https://dash.cloudflare.com/?to=/:account/support as only support can fix this on their side.

Your domain is active, DNSSEC is not an issue, and you have no DNS entries which may prevent the validation.

But nonetheless, please do fix all your other sites as well, as you force them on HTTP right now and send all traffic unencrypted over the network.

[adsense-ar]

Thanks @sandro ! I know that, but believe me, is not in my hands where my clients put their sites.

Thanks a lot!

[sandro]

That is true, but the encryption mode is . If your client refuses to secure their site, then that’s okay, but then the encryption mode should be Off.

Flexible is a legacy mode which typically breaks sites.

[adsense-ar]

Done! it was definitively an issue between CF and the DNS propagation (because we changed records in the zone, and then completely changed the DNS of the domain to have CF)