Custom Domains·3 min read·

SSL certificate stuck on Pending SSL for more than 30 minutes

What to do when your DNS has verified but the certificate stays inactive after 30 minutes, including when to escalate to support.

Once your CNAME verifies, Railway (which routes custom domains for VeloCMS) starts provisioning a certificate automatically. Most of the time this completes within 5-15 minutes. But if the domain is still not Active after 30 minutes, something is blocking the validation challenge.

Most common culprits

  • CAA (Certification Authority Authorization) DNS record blocking the certificate authority. Check for a CAA record on your apex domain and either remove it or add a '0 issue "letsencrypt.org"' entry.
  • Cloudflare proxy orange-clouded on the CNAME — while Proxied, DNS lookups return Cloudflare's IPs instead of your real target, so verification and the certificate challenge can't see your record.
  • A firewall or page rule on your domain blocking the validation request.
  • Domain was just transferred between registrars and is in a 60-day transfer lock — some registrars block DNS changes during this window.

How to check for CAA records

dig CAA example.com +short
# If you see output like '0 issue "sectigo.com"' but no Let's Encrypt entry,
# add: 0 issue "letsencrypt.org"

The 24-hour threshold

If provisioning fails outright, the domain's status in the panel changes to Failed with the underlying error shown. The fastest recovery path is to disconnect the domain (Admin → Settings → Branding, Custom Domain section, Disconnect button) and add it again. This registers the domain afresh and restarts verification and certificate provisioning from scratch.

Disconnecting and re-adding doesn't affect your blog content or subscriber data. Your blog will temporarily be accessible only via its velocms.org subdomain while the new certificate provisions.

Escalating to support

If reconnecting doesn't resolve it within another 30 minutes, contact support from the Help menu. Include the domain name, your account email, when you first connected the domain, and the error shown next to the Failed status. We can inspect the routing side and manually trigger a re-issuance if needed.

Related pages