Confirm the affected hostname, Cloudflare zone status and certificate type. Record when the certificate was requested and any displayed validation message or required DNS record.

1. Open SSL/TLS > Edge Certificates and inspect the certificate covering the hostname.
2. Check that the zone is active and its nameserver or supported partial setup is correct. Verify the hostname is within the certificate’s intended coverage.
3. Follow the displayed domain-control-validation instructions, if any, and check that authoritative DNS contains the required records.
4. Review restrictive CAA records, DNSSEC errors or conflicting validation records with the current Cloudflare guidance. Preserve unrelated certificate authorisations.
5. Allow the documented issuance process to complete, then test the certificate presented to a fresh browser. Escalate with status, hostname and timing if it remains stuck beyond the applicable provisioning window.

The edge certificate should become active and cover the hostname visitors use. Test from a client that reaches Cloudflare, not a local hosts-file override to the origin.

Deeper subdomains may require different certificate coverage than a default first-level wildcard provides. Do not disable and re-enable Universal SSL casually during an outage, because that can remove active edge coverage and start provisioning again.

No. They protect separate connections and have separate issuance and coverage requirements. Inspect the certificate at the endpoint that is actually failing.

• Moving a Cloudflare site to Full strict TLS safely
• Using a wildcard DNS record without overriding explicit hostnames
• Enabling Cloudflare DNSSEC with the correct registrar DS record
• Diagnosing Cloudflare error 525 during the origin TLS handshake

• Cloudflare: Troubleshooting
• Cloudflare: Changing Dcv Method