SSL troubleshooting

Common certificate failures and fixes.

Who can use this page? Anyone issuing certs; server-level fixes may need NitHost support.

DNS not pointing here

Symptom: Challenge fails; wrong site served.

dig +short example.com A

Must match the server’s public IP. Wait for propagation; remove stale records.

Port 80 blocked

Symptom: HTTP-01 timeout / connection refused.

• Open 80 and 443 in UFW/firewalld and any cloud security group
• Do not put a dropping CDN in front during HTTP-01 unless using a supported method

Rate limits

Let's Encrypt limits certificates per registered domain. Repeated failed attempts can hit failed validations limits — wait or use staging for tests.

Wrong vhost / site disabled

Challenge path must reach NitHost’s ACME webroot. Ensure the site is active and you are not redirecting /.well-known away.

Cloudflare DNS-01

Issue	Fix
Token invalid	Recreate with DNS edit on that zone
Renew fails after token rotate	Update site DNS-01 field / stored creds
Proxied orange cloud	DNS-01 still works; HTTP-01 through proxy needs care

After fixing

1. Reissue / renew from SSL page
2. Confirm new expiry date
3. Test in a private browser window

Panel domain certificate

If the hosting panel itself shows a certificate error, contact NitHost support. Changing your site certificate will not repair the panel certificate.

Related

• Issue a certificate
• Renewal