Certificate Request Error for Custom Domain - GitHub Pages

[jcavalca]

Select Topic Area

Question

Body

Certificate request error is persistent for a few days after ensuring a couple things:

• A records pointing to GH servers
• CNAME with www subdomain pointing to ondasoftware.github.io

joaocavalcanti@Mac-15 ~ % dig www.seedsensesoftware.com

; <<>> DiG 9.10.6 <<>> www.seedsensesoftware.com
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36242
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1

;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
;; QUESTION SECTION:
;www.seedsensesoftware.com.	IN	A

;; ANSWER SECTION:
www.seedsensesoftware.com. 3597	IN	CNAME	ondasoftware.github.io.
ondasoftware.github.io.	3597	IN	A	185.199.111.153
ondasoftware.github.io.	3597	IN	A	185.199.108.153
ondasoftware.github.io.	3597	IN	A	185.199.109.153
ondasoftware.github.io.	3597	IN	A	185.199.110.153

;; Query time: 3 msec
;; SERVER: 2600:6c52:7af0:9640::1#53(2600:6c52:7af0:9640::1)
;; WHEN: Mon Jan 20 11:47:16 PST 2025
;; MSG SIZE  rcvd: 154

This is blocking us from enabling HTTPS on our domain. In addition, fwiw, we're using AWS Route 53 and hosted zones to define such records.

NOTE: I'm not sure if this is relevant to the issue but we have also defined another subdomain under app.seedsensesoftware.com

[usama7365]

Based on your dig output, your DNS configuration looks fine with the CNAME pointing to ondasoftware.github.io and the A records being correctly set to GitHub's IPs.

One thing to check is whether you've correctly configured your GitHub Pages settings. For custom domains, you need to ensure that:

1. CNAME file: You should have a CNAME file in your repository (at the root) containing your custom domain (www.seedsensesoftware.com).

2. GitHub Pages settings: In the repository settings, under "Pages", double-check that the custom domain is set correctly and that GitHub is recognizing it.

3. SSL certificate issue: Sometimes, SSL certificates can take some time to propagate, especially if you're using AWS Route 53. Try re-saving the custom domain settings in GitHub Pages, which can trigger the system to request a new certificate.

4. Propagation time: DNS changes can take a while to propagate globally. You might need to wait a bit longer for DNS and SSL certificates to sync.

The subdomain (app.seedsensesoftware.com) shouldn't interfere, but just make sure it's not configured to point to a different server or resource that could cause DNS conflicts.

Cheers! 👋

[jcavalca]

Thank you so much @usama7365! I've also already added www.seedsensesoftware.com to the CNAME file on the repo, but still no luck

[usama7365]

Don't worry @jcavalca

If you've already configured the CNAME file and verified your DNS settings

1. Recheck DNS Propagation

• Use a DNS propagation checker (e.g., [WhatsMyDNS](https://www.whatsmydns.net/)) to confirm that the www.seedsensesoftware.com CNAME is globally resolving to ondasoftware.github.io.
• Ensure no conflicting DNS records exist, such as A or CNAME records for www.seedsensesoftware.com.

---

2. Verify GitHub Pages Settings

• In the repository:
  • Go to Settings > Pages.
  • Ensure the Custom domain is set to www.seedsensesoftware.com (with www).
  • Save changes even if it's already set.
• Check for the "Certificate request error" message. If it's visible, re-save the domain settings to trigger a new certificate request.

---

3. Root Domain Redirection

• If you want users to access the domain without the www, configure a redirect from seedsensesoftware.com to www.seedsensesoftware.com:
  • Add two A records for seedsensesoftware.com in Route 53, pointing to GitHub Pages IPs:

    185.199.108.153
    185.199.109.153
    185.199.110.153
    185.199.111.153
    

  • Set the Custom domain in GitHub Pages to the www version to avoid SSL conflicts.

---

4. Enforce HTTPS

• In GitHub Pages settings, ensure the Enforce HTTPS checkbox is enabled. If it's disabled, it means the SSL certificate hasn't been successfully issued yet.

---

5. Wait for SSL Propagation

• SSL certificate requests may take some time. After saving the custom domain settings, GitHub should automatically attempt to generate an SSL certificate for your domain.
• If propagation is taking too long (more than 24-48 hours), try re-saving the domain settings again.

---

6. Check for AWS Route 53 Settings Conflicts

• Ensure there are no conflicting configurations in the hosted zone. For example:
  • Verify that app.seedsensesoftware.com is correctly set as a separate subdomain and does not interfere with the main www subdomain or root domain.

---

7. Contact GitHub Support

• If the issue persists despite all these checks, it might be a problem on GitHub's end with their SSL issuance process. Open a support ticket with GitHub, providing:
  • Your repository name.
  • The custom domain.
  • The DNS settings (from a tool like dig or nslookup).

---

Cheers! 👋

[ConnectedCat]

Similar persistent issue with my Pages setup. I checked the first 6 points from usama7365 answer but no luck. If there is a solution I would like to know

[usama7365]

---

Hey @ConnectedCat,

I totally get how frustrating this can be! Since you've already gone through the first six steps, let’s try a few additional things:

1️⃣ Manually Trigger SSL Certificate Renewal

Sometimes, GitHub Pages gets stuck while issuing an SSL certificate. Try:

• Go to Settings > Pages in your repository.
• Remove the custom domain, save, then re-add it.
• Make sure "Enforce HTTPS" is checked (if it's available).
• Wait 10–15 minutes and refresh the page to check for changes.

2️⃣ Double-Check Route 53 & Conflicting Records

• Run:

  dig www.yourdomain.com +short

  This should only return ondasoftware.github.io.
• If any extra A or CNAME records exist that point somewhere else, remove them.
• If using Cloudflare, temporarily disable "Proxy" mode (set DNS records to "DNS only").

3️⃣ Clear Old SSL Configurations

• If you've switched from another hosting provider (e.g., Netlify, Vercel), old SSL settings might interfere.
• Try removing your domain from GitHub, waiting a few hours, then re-adding it.

4️⃣ Contact GitHub Support

If nothing works, this may be an issue on GitHub's end. Reach out to GitHub Support with:

• Your repository name
• The exact domain name
• DNS lookup results (using dig or nslookup)

Let me know how it goes—I’m happy to help troubleshoot further! 🚀

Cheers,
Usama 😊

[jcavalca]

Hello guys! My situation happened after I transitioned my domain from Google to AWS. Apparently, my domain still had DNSSEC signing turned on but Route 53 had an invalid key setup. After turning DNSSEC signing off on Route 53, it started working for me (after I had already followed the steps from GH documentation)

Thank you very much for the support @usama7365 🙏

[usama7365]

hi @jcavalca mark the issue as answered

Thanks