Universal SSL ticket pending validation (txt) for over 48hrs

[alecaudet]

Answer these questions to help the Community help you with Security questions.

What is the domain name?
aud.et

Have you searched for an answer?
Yes, I have found to try toggling “universal SSL” to off for 5 minutes then back on and waiting 24 hours.

When you tested your domain, what were the results?
SSL error due to no certificate

Describe the issue you are having:
Universal SSL edge certificate is marked as “pending (txt)” for over 48 hrs even after toggling Universal SSL. Domain DNS is managed by cloudflare and the pending notice says that no action is required on my end - however, the documentation says 24hours is the max wait time and it has been double that.

[DarkDeviL]

@alecaudet

aud.et

As we’re dealing with a TLD that doesn’t support DNSSEC, that shouldn’t be able to be the problem.

@alecaudet

Universal SSL edge certificate is marked as “pending (txt)”

What certificate authority?

@alecaudet

however, the documentation says 24hours is the max wait time and it has been double that.

It says “should”.

I believe you should interpret that part as “what is probable”, e.g. typically / under normal conditions, and assuming nothing else prevents the certificate issuance.

That being said, - do you mind taking a look at your DNS records?

→ https://dash.cloudflare.com/?to=/:account/:zone/dns/records

Do you have any DNS record(s) listed, where the Name field contains “_acme-challenge”?

[alecaudet]

Hi thanks for replying,
Here is my DNS. I have manually added the TXT verification records after waiting 24 hours. As the notification for pending verification says I dont need to do anything, but I tried regardless.
Its also worth noting that the ACME challenge codes appear to rotate once a day, and I have updated them twice now.

[alecaudet]

Here is CA info

[DarkDeviL]

@alecaudet

I have manually added the TXT verification records after waiting 24 hours

Can you try deleting them?

@alecaudet

As the notification for pending verification says I dont need to do anything, but I tried regardless.

I would strongly advice going against such advice, as it would more often be causing conflicts rather than doing anything good.

@alecaudet

Here is CA info

I currently see 6 _acme-challenge records in the DNS for your domain, including the two from your screenshot.

Can you try the following:

1. Disable Universal SSL
   → https://dash.cloudflare.com/?to=/:account/:zone/ssl-tls/edge-certificates

2. Wait 2 hours

3. Check the DNS, could be with a tool like digwebinterface.com, dnschecker.org or similar site, for the TXT record of _acme-challenge.aud.et, and see if there are still remaining _acme-challenge TXT record(s) left then?
   → Dig web interface - TXT record for _acme-challenge.aud.et
   → dnschecker.org - TXT record for _acme-challenge.aud.et

4. Respond back with what you see regarding #3.

Also, do you see any certificates with the status Active (e.g. a Backup), under Edge Certificates?