Troubleshooting SSL Certificates

If your certificate won’t issue, the most common cause is that DNS routing has not been verified yet: HEIMWALL can only obtain the automatic certificate once traffic flows through it. Work through the checklist below in order.

Diagnostic checklist

1. Is DNS verified? On Console → WAF → [your domain] → Addresses you should see the “Routing verified” badge. If it says “Routing pending”, your domain’s A/AAAA records do not point at the HEIMWALL edge IPs yet — certificate issuance only starts after verification. Check your DNS records and wait for propagation; the status updates automatically.

2. Is Automatic SSL on? On Console → WAF → [your domain] → SSL/TLS, make sure the Automatic SSL toggle is enabled.

3. Check the certificate status. On Console → WAF → [your domain] → Certificates, read the Current Certificate card: it shows the issuer, validity dates and days remaining. Obtaining a certificate can take up to 6 minutes including CA validation — if you just enabled Automatic SSL, be patient; the SSL/TLS page shows the issuance progress and any error.

4. Re-trigger issuance. If the process looks stuck, turn the Automatic SSL toggle off and back on at the SSL/TLS page — this restarts certificate issuance from scratch.

5. Know the ACME validation prerequisites.

   • HTTP-01 validation requires traffic to flow through HEIMWALL (which is why step 1 is a prerequisite).
   • DNS-01 is only possible if your domain uses HEIMWALL Managed DNS; it is required for wildcard certificates.
   • The certificate authority (Let’s Encrypt / ZeroSSL) is managed by HEIMWALL; there is nothing for you to choose.

6. Hit a CA rate limit? Too many attempts in a short period can hit a CA rate limit. Wait a while and retry with step 4; if the problem persists, contact support.

7. Last resort: upload a certificate manually. First turn off Automatic SSL on the SSL/TLS page (if it stays on, automatic renewal will overwrite your manual certificate), then on the Certificates page paste your certificate and private key in PEM format and click Verify and Upload; you can optionally add a secondary ECDSA pair. Your site keeps serving HTTPS while you resolve the automatic flow.

Dual certificates (ECDSA + RSA)

HEIMWALL manages ECDSA and RSA certificates together for the same domain, and they renew independently. The Current Certificate card shows the key types and the ECDSA expiry separately — check both.

Verification

Once the certificate is issued:

openssl s_client -connect yourdomain.com:443 -servername yourdomain.com </dev/null 2>/dev/null | openssl x509 -noout -dates -issuer

You should see the validity dates and the CA in the output. Also confirm the padlock appears in the browser. The badge on the Certificates page should read Valid.

Certificate ManagementAutomatic SSL and all TLS settings.

DNS SetupPoint your A/AAAA records at HEIMWALL.