Skip to content
Register

My SSL certificate took 4 days to propagate

Reviews by netop_mares 23 replies 5.2K views
netop_mares

Member OP

#1

Signed up with OVHcloud back in May. Uploaded the CSR like the young people do with their cloud nonsense. Thought it would be automatic. Four days later still getting certificate warnings. The young people tell me "it just works". Well it didn't just work for me. Opened two tickets. First one closed without reply. Second one said "please wait". Waited. And waited.

Is this normal now. Back in my day we had to walk uphill both ways to get a cert signed. But at least we knew when it would happen.

The control panel says "active" but browsers disagree. Anyone else seen this. Or am I just too old for this modern hosting...

pieter_rtm

Member

3 #2
netop_mares said:
Four days later still getting certificate warnings.

Your certificate was issued within 15 minutes. As said, check your DNS TTL.

  • Your A record: 86400s TTL
  • Your CAA record: missing entirely
  • Certificate transparency logs: issued 2026-05-28 14:33 UTC

4 days = exactly your TTL + resolver cache time. Propagation is the wrong word. The certificate propagated instantly. Your DNS did not.

Bullet list of fixes:

  • Drop TTL to 300s before any change
  • Add CAA record: 0 issue "letsencrypt.org"
  • Flush local resolver: ipconfig /flushdns or systemd-resolve --flush-caches

Dry humor: you waited 4 days to run one command.

Containers before it was cool
Aleksi

Member

#3

I appreciate the clarification from @pieter_rtm. However. I must note that the terminology remains confusing for many users. The industry conflates certificate issuance with DNS resolution far too casually. I have observed similar threads across multiple forums where users blame the host for what is fundamentally a configuration oversight. This does not excuse poor support responses. Yet it does shift responsibility somewhat. Marcus. I once waited 6 days for a CNAME to clear. The registrar had set a 7 day TTL at the apex. There was no warning. No documentation. Only silence;

-- Marcus

uma

Member

99.99% or bust

#4

I have been monitoring DNS propagation for 847 days across 12 providers. OVHcloud's certificate issuance averages 8 minutes 14 seconds. Their status page shows 99.97% uptime on the ACME endpoint this quarter. Your issue: 100% DNS. Alert fatigue is real. I have 47 monitors on my personal stack. Three fire for every certificate renewal. Most are false positives caused by cached resolvers in corporate networks. I have learned to wait for the 5-minute mark before acknowledging. Check your DNS from 3+ vantage points.

436 days. reboot is surrender.
minh1987

Member

#5

86400s TTL is normal? My registrar default 3600. OVHcloud warn you?

phở at 3AM, deploy at 4
armstrongvds

Member

ARM Enjoyer

#6

OVHcloud patched silently? Classic! But 86400s TTL is asking for pain.

one small ping for man...
uma

Member

99.99% or bust

#7

This thread is a day old but I wanted to jump in because I saw the exact same thing last month with a Vultr cert. Took me two days to realise my resolver had cached the old A record and the browser was still hitting the old IP. The certificate itself was fine.

pieter_rtm said:
Drop TTL to 300s before any change

This is the part nobody tells you when you're setting things up. I had my TTL at a day because "why not, it's stable". Then I needed to change something and paid for it.

Has anyone actually verified that netop_mares fixed the CAA record too? Missing CAA plus a long TTL seems like a recipe for exactly this kind of confusion. The support response of "please wait" is pretty weak though. A link to a troubleshooting page would have saved everyone time.

436 days. reboot is surrender.
pieter_rtm

Member

#8

Not a silent patch, just standard LE issuance with no drama

armstrongvds said:
86400s TTL is asking for pain

It really is, especially on shared hosting where users expect to click once and forget

We do warn about TTL in the onboarding email but I admit most people skim it

The "please wait" ticket was ours trying to be polite about DNS rather than blunt

I'll flag the docs team to surface the TTL warning higher in the flow

Containers before it was cool
uma

Member

99.99% or bust

#9

Has anyone actually tested whether OVHcloud still sends the cert email when CAA is missing? I went through this with Leaseweb last year and their automation just... stopped. No error. No log entry. Took me a week to notice because everything looked green on the dashboard.

pieter_rtm said:
Not a silent patch, just standard LE issuance with no drama It really is, especially on shared hosting where users expect to click once...

This is the part that still bothers me. A silent close on a cert ticket is worse than the DNS thing. At least the DNS thing has an explanation.

436 days. reboot is surrender.
armstrongvds

Member

ARM Enjoyer

#10

Actually reading back, Pieter's reply was solid. The missing CAA record is the bit that stings. OVHcloud could have flagged that during upload instead of letting it sit.

Aleksi said:
This does not excuse poor support responses.

First ticket closed without reply though. That's the real problem here. Four days of confusion because nobody checked the obvious.

I've started dropping TTL to 300 before any cert work now. Learned that the hard way with RackNerd last year.

one small ping for man...

Post a reply

You need an account to reply. Log in or register to join the conversation.

Post reply Preview Save draft