Troubleshooting
Stable error codes, order states and the checks that actually distinguish issued from served.
Order stuck pending
Read the challenge on GET /certificate-orders/{id}. For DNS-01, query TXT at _acme-challenge. For HTTP-01, GET the token URL from a network the CA can reach. Then POST validate.
wildcard_requires_dns
HTTP-01 cannot validate *.example.com. Use dns-01.
Issued but HTTPS still old
The CA finished. The listener did not. Connect a deploy target or install PEM yourself, then compare the served SHA-256. certificate.issued is not a deploy.
Renewal failed
certificate.renewal_failed includes error_code. Common causes: CAA, expired DNS token, rate limit, disconnected target. Action Required is for a person, not a green dashboard.
Related
Errors /docs/errors. Deployments /docs/deployments. Insights /insights/renewal-automation-fails-without-deployment.