Question: Why was the Klai TLS certificate stuck on “Awaiting validation to generate TLS certificate” even though the custom domain resolved correctly?
Answer: Cloudflare’s proxy was enabled, so Cloudflare terminated TLS and served its own certificate. Let’s Encrypt could not reach Klai’s certificate-validation endpoint: HTTP validation was redirected to HTTPS by Cloudflare, while HTTPS was handled by the application instead of Klai’s certificate manager. Set the www DNS record to DNS only (grey cloud), CNAME it to alias.bfoperations.com, and leave the proxy disabled until the certificate warning clears. The custom domain does not need to be deleted and re-added; allow time for Klai’s queued validation check to run.
Thread Attachments
Original Slack Thread
User UV397LLAX: Anyone around to check a secure certificate issuing?
User UBBJX2EHM: do you have that domain behind cloudflare etc?
User UBBJX2EHM: i see the site is live, but waiting for forwarding, we 2x check again in am to see if it resolves
User UV397LLAX: I removed and added it twice. It wasn't proxied, but it wouldn't validate. I waited 30-60 minutes each time. I had to get the site up so I proxied it and set SSL/TLS encryption mode to Full and that is working.
User UV397LLAX: I know it won't validate now. I would like to know if it was something on my setup before I put the custom domain back to DNS only to get the proper cert from Klai.
User UBBJX2EHM: With the proxy on, Cloudflare is terminating TLS. Visitors get Cloudflare’s certificate for `*.<http://uiece.com|uiece.com>`, and the site can stay up that way. Klai’s certificate check does not complete in that setup: port 80 on `/.well-known/acme-challenge/` is redirected to https by Cloudflare, and https is answered by the app, not by our certificate manager. It will stay on “Awaiting validation to generate TLS certificate” until the record is DNS-only again.
The warning in your screenshot is already the certificate step, not the DNS-forwarding step. By 5:39 PM yesterday we had moved past “awaiting DNS forwarding” and were waiting on the Let’s Encrypt check. I can’t see what DNS looked like during the two unproxied attempts, because it is proxied now.
When you switch it back, grey-cloud the `www` record, CNAME it to `<http://alias.bfoperations.com|alias.bfoperations.com>`, and leave the proxy off until that warning clears. The “last checked” time is the last time our job wrote the status, so give it a bit after the DNS change. If it sits on that same TLS message again while it is actually DNS-only, tell me and we’ll look at it from our side.
Custom domain steps, including the forwarding check and the path-based certificate check, are here: <https://docs.klai.studio/reference/security/custom-domains|docs.klai.studio/reference/security/custom-domains>
User UV397LLAX: Do I need to delete the custom domain and readd it or can I just change it to DNS only in Cloudflare and wait.
User UBBJX2EHM: No, this issue is not with Klai, it is because you are using cloud flare. Dod you look at the doc link?
User UV397LLAX: Yes. I checked for DNS propagation via dig and a website and <http://www.uiece.com|www.uiece.com> was resolving to <http://alias.bfoperations.com|alias.bfoperations.com> I only turned on proxy when it wouldn't issue the cert.
User UBBJX2EHM: dns forwarding was a diff issues, this is for the certificate
User UBBJX2EHM: Lets Encrypt needs to be able to hit our DC
User UBBJX2EHM: but cant
User UV397LLAX: I didn't see any other configuration with Cloudflare other than setting it to DNS only, which is what it was set to when I added this custom domain. Could my redirect rule of my apex domain to www cause this issue?
User UV397LLAX: I will just try it again with DNS only turned on when the site is quiet. I don't need to delete and readd the domain to start the process again, the domain will just get checked in a queue?
User UBBJX2EHM: you should be able to task your ai this. Others in the slack have recently done it also
User UBBJX2EHM: <https://fmbetterforms.slack.com/archives/CBH103V3R/p1789492876735019|https://fmbetterforms.slack.com/archives/CBH103V3R/p1789492876735019>