TLS problems

For Site HTTP-01 Let's Encrypt problems, check that the hostname resolves to this server, TCP port 80 reaches it, no external proxy is sending the challenge elsewhere, and the requested hostname is correct.

Wildcard and DNS-01 problems

Wildcard certificates require DNS-01. For Automatic DNS · Cloudflare, confirm the configured provider is ready, has access to the intended zone and can write DNS records. If the required fixed DNS challenge component is missing, install it from Components and retry.

For Manual DNS Challenge, publish the exact TXT name/value shown by Control. Wait until the authoritative DNS service returns the new TXT value before acknowledging the challenge. Closing the browser does not cancel the manual certificate session; return through Sites → Certificates and continue it.

A manual DNS certificate cannot renew unattended because Control does not own the external DNS mutation. When it enters the renewal window, start manual renewal and complete the new TXT challenge.

Coverage and attachments

If attachment is rejected, compare every Site hostname with the certificate's covered names. *.example.com covers blog.example.com but not example.com or a.b.example.com. Include the apex explicitly when it is needed.

If opening one hostname over HTTPS shows a different Site hosted on the same server, treat that as a virtual-host ownership problem. Control should keep TLS pending or report drift until the intended Site is the verified HTTPS owner.

Imported certificates

For an imported certificate, confirm the certificate/private key pair belongs together, the certificate is currently valid and its SANs cover every Site you want to attach.

If the Site remains healthy over HTTP, fix the TLS cause and retry or reattach the certificate. Do not delete and recreate a healthy Site merely because certificate activation failed.

Cloudflare-proxied hostnames

When the orange Cloudflare proxy is enabled, public A/AAAA lookups return Cloudflare anycast addresses rather than the Control origin. If Cloudflare is configured as a Control DNS provider, Control verifies the exact proxied record’s origin instead of comparing edge addresses with the server IP. If readiness still reports an origin mismatch, verify the Cloudflare record itself targets the current Control public ingress address.

A DNS/readiness failure that occurs before ACME mutates certificate state is a preflight failure; it does not by itself mean the certificate requires rollback or reconciliation.

www returns 421 Misdirected Request

Control deliberately isolates unknown HTTPS hostnames with a 421 response rather than allowing another managed Site to answer them. If the primary domain works but www. returns 421, confirm that the www. DNS record points to this Control host, then open the Site’s SSL workspace and expand the Let’s Encrypt certificate to include the ready www. companion. Control attaches it to the same Site before issuing the expanded certificate.