Fixing HTTPS when the certificate will not issue

Certificates are issued by Let's Encrypt and renewed automatically. When one will not issue, it is nearly always one of three things.

1. The domain is not resolving here yet

Issuance works by fetching a challenge over your domain, so the domain has to point here first. The order cannot be shortcut.

Check the Domains screen says the domain is live. If it does not, fix the DNS first — the certificate follows on its own once that is done.

2. A CAA record is blocking it

A CAA record names which certificate authorities are allowed to issue for your domain. If yours names a different one — left over from a previous host or a paid certificate — Let's Encrypt is refused, and the error does not obviously mention CAA.

Check: look up CAA for your domain on dnschecker.org, or run dig CAA yourdomain.com.

Fix: either delete the CAA records, or add one allowing Let's Encrypt:

yourdomain.com. CAA 0 issue "letsencrypt.org"

Then press Check now on the Domains screen.

Check this first if the domain resolves correctly and the certificate still will not issue. It is the cause people spend hours missing.

3. The weekly allowance is used up

Let's Encrypt limits how many certificates can be issued for one registrable domain per week. Adding and removing a domain repeatedly — a common reflex when something is not working — exhausts it, and then nothing we do issues a certificate until the window rolls.

The fix is to wait. Add the domain once and leave it. The allowance recovers within a week and issuance then happens on its own.

Mixed content warnings after HTTPS starts working

The padlock appears but the browser says the page is not fully secure. That is your own content loading over http://.

1. In WordPress, Settings → General: both addresses should start https://.
2. Old posts often contain hard-coded http:// image URLs. A search-and- replace plugin such as Better Search Replace fixes them in one pass — take a backup first.

Force HTTPS is on by default on your Pressy, so visitors arriving on http:// are redirected regardless.

When to write to us

Write to us if the domain resolves here, there is no CAA record, and no certificate has appeared after an hour. Send the domain name.