Verify DNS
On the command line using macOS, Linux, or the Windows Subsystem for Linux, run the following command:example.com, the response should be something like the following:
- Your DNS server might not be correctly configured or the old DNS records are still cached. Try removing your local DNS cache.
- Set your computer’s DNS server to any Public DNS resolver (like CloudFlare or Google) to see if the issue is with the DNS server you are using.
- Run
ping www.<YOUR_DOMAIN>. If the result is different from what you got from runninghost www.<YOUR_DOMAIN>, you might need to remove your test settings.
Verify SSL/TLS encryption
To find out where your domain is pointing to, you can use the certificate checker tool. This tool provides guidance on certificates, including when you use a CDN. Check both the apex and thewww domains to ensure they both point to your project.
For further investigations, run the following command in a shell:
Error provisioning certificates
When a Let’s Encrypt certificate fails to provision after the build hook has completed, you get output similar to the following:<YOUR_DOMAIN>= the amount of characters your domain has<ENVIRONMENT>=<BRANCH_NAME>+ 7 character hash<PROJECT_ID>= 13 characters<REGION>= 2 to 4 characters, depending on the regionplatformsh.site= 15 characters- extra characters like
.and-= 4 to 5 characters, depending on if you have a default domain
<BRANCH_NAME>) without exceeding the 64-character limit,
depending on the region.
To ensure your renewals succeed,
keep your branch names under 20 characters.
Ownership verification
To provide a valid TLS-certificate, the certificate issuer checks that the requester is entitled to receive the requested certificate. This check is known as the Challenge step. The certificate request is generated based on your routes definition. If you want your site to be available withexample.com and its www.example.com subdomain, make sure both are defined in your routes.
To pass this verification, there are requirements you need to meet.
- Without a CDN
- Using a CDN
Upsun checks that all the routes you defined are pointing to your project.
For the challenge to complete,
domains and subdomains must point directly to your Upsun project.Otherwise, you get an error similar to:
www subdomain are both pointing where needed.
Note that it can take up to 72 hours for DNS changes to be effective.
For more information, see how to set up a custom domain.
If the changes take longer than expected,
redeploy the impacted environment.
Also make sure that no conflicting DNS records exist for your domain.
For example, a conflicting AAAA (IPv6) DNS record can result in a [HTTP01: The client lacks sufficient authorization] error.
If the certificate generation issue persists,
check if an outage is ongoing with your certificate issuer (the most common one is Let’s Encrypt)
and with your CDN provider if you have one.
If not, contact Support.
Check your routes configuration
Certificates are generated based on your routes configuration. When a certificate is renewed, the renewal bot checks that all of the defined routes can be accessed. If at least one of the routes defined in your.upsun/config.yaml file can’t be accessed,
the renewal fails and the following error is displayed:
example.com and www.example.com to your routes configuration
but the www subdomain doesn’t point to your project through a CNAME record,
the certificate renewal fails.
For the renewal to succeed, add the missing CNAME record to your DNS
or remove www.example.com (and any other www route) from your .upsun/config.yaml file.
Verify your application
Check your app’s logs and look for anomalies. On the command line typeupsun logs app and upsun logs error.