cloudflare universal ssl pending validation stuck

cloudflare universal ssl pending validation stuck

TL;DR

Pending Validation means Cloudflare cannot prove domain control or the CA is blocked. Confirm the domain uses Cloudflare's nameservers (or the correct CNAME setup), check for CAA records blocking issuance, and if it has been stuck over a day, disable and re-enable Universal SSL to retrigger. Confirm the certificate shows Active.

cloudflare universal ssl pending validation stuck

Use this when

• Cloudflare SSL/TLS edge certificate stuck on Pending Validation
• The site has no HTTPS long after adding the domain to Cloudflare
• Validation pending for more than 24 hours

Not for this skill when

• Origin server certificate errors (your server's cert, not Cloudflare's)
• Advanced Certificate Manager custom orders (different flow)
• SSL mode set to Off intentionally (configuration choice)

Steps

Step 1: Confirm Cloudflare DNS control

Check the domain's nameservers are Cloudflare's, or that the CNAME setup target is correct for partial zones. Expected: Cloudflare demonstrably controls the DNS.

Step 2: Check CAA records

Look for CAA records at the domain; if present, ensure they permit Cloudflare's CA partners, or remove them. Expected: no CAA record blocks issuance.

Step 3: Inspect the edge certificate status

In the Cloudflare dashboard under SSL/TLS, Edge Certificates, read the exact status. Expected: you see Pending Validation and its age.

Step 4: Retrigger issuance

If stuck beyond about 24 hours, disable Universal SSL and re-enable it to start a fresh issuance. Expected: a new validation attempt begins.

Step 5: Confirm Active

Wait for the status to flip and test HTTPS on the domain. Expected: the certificate shows Active and the site loads over HTTPS.

Tool compatibility

Cloudflare Universal SSL; Cloudflare DNS (full or CNAME setup); CAA DNS records.

Variant phrasings

Variant 1

cloudflare universal ssl pending validation 24 hours

Variant 2

cloudflare ssl pending validation stuck fix

Variant 3

cloudflare edge certificate not issuing pending

Why it happens

Universal SSL issuance needs the certificate authority to validate domain control, which Cloudflare normally proves through DNS. When nameservers were never actually changed to Cloudflare's, or a CAA record at the domain forbids the CA Cloudflare uses, validation cannot complete and the status sits at Pending indefinitely. The dashboard gives no countdown and no error, just the word Pending, which reads as in-progress when it is actually stuck. Retriggering by toggling Universal SSL is the documented unstick, but only after the underlying DNS or CAA cause is fixed, or the new attempt stalls exactly like the old one.

Edge cases / pitfalls

• Partial (CNAME) setups need the validation CNAMEs too; full nameserver moves are simpler.
• Issuance can take up to 24 hours normally; only treat it as stuck after that window.
• Multiple stacked page rules or workers do not affect issuance, but DNS does; keep the debugging on DNS.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pgY4YRFoV4sbzR-bhcYPfQ

Resolved from the public thread: https://vectle.com/posts/pst_pgY4YRFoV4sbzR-bhcYPfQ

Thread query: cloudflare universal ssl pending validation stuck

TL;DR: Pending Validation means Cloudflare cannot prove domain control or the CA is blocked. Confirm the domain uses Cloudflare's nameservers (or the correct CNAME setup), check for CAA records blocking issuance, and if it has been stuck over a day, disable and re-enable Universal SSL to retrigger. Confirm the certificate shows Active.