Resolving status page certificate renewal failures
Overview
We email you when the SSL certificate for your status page's custom domain cannot be renewed. The certificate keeps working until it expires, and then visitors see a browser security warning instead of your status page.
This article explains what to check. You do not have to do it all - the first item is the cause in most cases.
What to check
1. Check the CAA record
A CAA record is a DNS record that says which certificate authorities may issue a certificate for your domain. If a CAA record exists and does not allow the authority that issues your certificate, renewal fails.
To see the record:
dig CAA status.example.com
dig CAA example.com
To allow Let's Encrypt, the CAA record should contain:
0 issue "letsencrypt.org"
The record can sit on the status page hostname itself or on its parent domain. A parent domain record applies to every hostname below it, so check both.
2. Check that a CAA record and a CNAME record do not share a hostname
A hostname cannot have both a CAA record and a CNAME record. If the status page hostname is a CNAME (the usual setup for a custom domain), remove any CAA record on that exact hostname and keep it on the parent domain instead.
3. Check that the DNS records still match StatusGator
In StatusGator, open the board, then the status page, then Settings, then Domain. The records shown there must still be the ones at your DNS provider. A hosting change, a domain transfer or a new DNS provider often leaves the old records behind.
4. Check for validation records and proxies
Certificate validation uses temporary DNS records. Stale validation records can stop a new certificate from being issued. A redirect, a proxy or a WAF in front of the hostname can also block the validation request.
After you fix it
Renewal is automatic. Once the DNS records are correct, the next renewal attempt succeeds - usually within a few hours, sometimes a day. There is nothing to trigger by hand.
If renewal still fails after the DNS is corrected, reply to the email you received. We will check the certificate from our side and take it further with our hosting provider.
Checking the expiry date yourself
Every certificate carries an expiry date. You can see it in your browser: open the status page address, click the padlock in the address bar, then the "Connection is secure" entry. The certificate's validity dates are listed there.