我的书签
添加书签
移除书签Troubleshooting (31)·续
</details>
Timed out validation
A custom hostname enters Timed Out Validation (ssl.status: validation_timed_out) when DCV did not complete before the retry schedule ended.
To restart the DCV cycle, send a configuration-neutral PATCH request to the Edit Custom Hostname endpoint. Retrieve the current hostname with a GET request first, then echo ssl.method, ssl.type, and ssl.settings exactly as returned.
<details>
<summary>
Example API call
</summary>
# Step 1: retrieve the current ssl configuration
curl "https://api.cloudflare.com/client/v4/zones/{zone_id}/custom_hostnames/{custom_hostname_id}" \
--header "Authorization: Bearer <API_TOKEN>"
# Step 2: send a PATCH using the ssl object from the GET response.
# ssl.settings must be included as an object if present; omit the field entirely if absent or null.
curl --request PATCH \
"https://api.cloudflare.com/client/v4/zones/{zone_id}/custom_hostnames/{custom_hostname_id}" \
--header "Authorization: Bearer <API_TOKEN>" \
--header "Content-Type: application/json" \
--data '{
"ssl": {
"method": "<method_from_get>",
"type": "dv",
"settings": { <ssl_settings_object_from_get> }
}
}'
</details>
After sending the PATCH, poll the Custom Hostname Details endpoint and check ssl.validation_records. Only share updated tokens with your customer if the token values have changed. Make sure the tokens are placed before they expire again.
Tip
If you are managing DCV tokens on behalf of your customers, consider using Delegated DCV to avoid manual token delivery altogether.
SSL.com: separate DCV cycles for RSA and ECDSA
When using SSL.com as the certificate authority, Cloudflare requests both an RSA certificate and an ECDSA certificate. Each certificate type goes through its own DCV cycle and can validate and issue independently. However, the certificate pack is not activated or deployed until both certificates have issued successfully.
Ask your customer to publish every TXT record returned in ssl.validation_records — do not assume the number of records or infer which corresponds to RSA or ECDSA. The field lists all pending authorizations and must be satisfied in full before the certificate pack becomes active.
High-risk domains
Cloudflare's CA partners occasionally flag a domain as "high risk" — typically only for domains that Google's Safe Browsing service has flagged for phishing or malware.
If a domain is flagged by the CA, you need to contact Support before validation can finish. The API call will return indicating the failure, along with a link to where the ticket can be filed.
Conflicting _acme-challenge TXT records
If certificate validation is stuck despite the correct CNAME or TXT records being in place, a conflicting _acme-challenge TXT record may be preventing the certificate authority from completing validation.
How to diagnose
Check whether the delegation CNAME is in place at the _acme-challenge hostname:
dig _acme-challenge.example.com CNAME +short
- If this returns nothing, the delegation CNAME is missing. Run a
TXTquery to check whether a hardcoded record is also present:
dig _acme-challenge.example.com TXT +short
```
If this returns a raw token string, a hardcoded `_acme-challenge` TXT record is blocking certificate issuance — remove it before adding the delegation CNAME.
- If this returns a **CNAME target** but certificate validation is still stuck, the conflict is likely a hardcoded `_acme-challenge` TXT record inside your customer's direct Cloudflare zone. Because resolvers follow the CNAME chain rather than exposing records at the source name, the only way to confirm this is to inspect the customer's zone directly: go to **DNS** > **Records** in the Cloudflare dashboard for their zone and look for any `_acme-challenge` TXT entries.
### Common causes and remediation
**Record from a prior Cloudflare certificate order** — Cloudflare adds `_acme-challenge` TXT records during certificate issuance. Records from a previous or abandoned order may persist and are not always visible in the Cloudflare dashboard. [Contact Cloudflare Support](https://developers.cloudflare.com/support/contacting-cloudflare-support/) to have them removed.
**Record in a direct Cloudflare zone** — If your customer's domain is also present in a direct Cloudflare zone (for example, they proxy `example.com` through their own Cloudflare account), that zone may have an `_acme-challenge` TXT record from a Universal SSL or Advanced certificate order. When the certificate authority queries `_acme-challenge.example.com`, it resolves the record from the direct zone rather than following the delegated DCV CNAME.
To resolve this, ask your customer to remove the `_acme-challenge` TXT record from their zone's DNS settings in the Cloudflare dashboard, then [trigger an immediate validation check](#immediate-validation-checks).
---
## Immediate validation checks
You can send a `PATCH` request to the [Edit Custom Hostname](https://developers.cloudflare.com/api/resources/custom_hostnames/methods/edit/) endpoint to request an immediate validation check on any certificate. Retrieve the current hostname with a GET request first and use the current `ssl` object (including `ssl.settings` if present) as the `PATCH` body, not the values from the original creation request.
---
## Related resources
- [Troubleshooting DCV](https://developers.cloudflare.com/ssl/edge-certificates/changing-dcv-method/troubleshooting/) — DCV issues that apply to all Cloudflare zones: WAF rules, redirects, DNS settings, and CA errors
- [Token validity periods](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/reference/token-validity-periods/) — how long DCV tokens remain valid per CA
- [DCV backoff schedule](https://developers.cloudflare.com/ssl/edge-certificates/changing-dcv-method/validation-backoff-schedule/) — how Cloudflare retries DCV before timing out
- [Validation status](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/domain-support/hostname-validation/validation-status/) — what each `ssl.status` value means
- [Delegated DCV](https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/delegated-dcv/) — let Cloudflare manage DCV on behalf of your customers
Was this helpful?
YesNo
## On this page
[Docs](https://developers.cloudflare.com/)
```json
{"@context":"https://schema.org","@type":"TechArticle","@id":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/troubleshooting/#page","headline":"Troubleshooting","description":"Resolve domain control validation failures and certificate issuance issues for custom hostnames.","url":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/troubleshooting/","inLanguage":"en","image":"https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/troubleshooting/og.png?v=9d2a249f28a574a1","dateModified":"2026-09-24","publisher":{"@type":"Organization","name":"Cloudflare","description":"One platform for your apps, agents, and workforce. Build, secure, and scale without managing infrastructure","url":"https://www.cloudflare.com/","sameAs":["https://github.com/cloudflare","https://www.linkedin.com/company/cloudflare","https://x.com/cloudflare"],"logo":{"@type":"ImageObject","url":"https://developers.cloudflare.com/logo.svg"},"address":{"@type":"PostalAddress","streetAddress":"101 Townsend St","addressLocality":"San Francisco","addressRegion":"CA","postalCode":"94107","addressCountry":"US"},"contactPoint":[{"@type":"ContactPoint","contactType":"Customer Support","url":"https://support.cloudflare.com/","availableLanguage":["English"]},{"@type":"ContactPoint","contactType":"Sales","url":"https://www.cloudflare.com/contact/","availableLanguage":["English"]}]},"isPartOf":{"@type":"WebSite","@id":"https://developers.cloudflare.com/#website","name":"Cloudflare Docs","url":"https://developers.cloudflare.com/"},"keywords":["Debugging"]}
description: Validate domain ownership with a TXT DNS record for certificate issuance. title: TXT image: https://developers.cloudflare.com/cloudflare-for-platforms/cloudflare-for-saas/security/certificate-management/issue-and-validate/validate-certificates/txt/og.png?v=e793d47c36c5d733
Documentation Index
Fetch the complete documentation index at: https://developers.cloudflare.com/cloudflare-for-platforms/llms.txt
Use this file to discover all available pages before exploring further.
