How long does it take to issue an SSL certificate?
Last updated
Table of Contents
The time required to issue a new SSL certificate depends on several factors: the SSL certificate type, the validation process used by the certificate authority, and how quickly validation steps are completed. Let’s Encrypt certificates are usually issued faster, because DNSimple completes their validation automatically. Sectigo certificates are issued after you approve the validation email, so the timing depends on that step. For how the two compare, see Sectigo vs Let’s Encrypt SSL Certificates.
Sectigo certificates
For Sectigo single-name and wildcard certificates, issuance begins once the certificate authority receives your email approval. The certificate is generated and signed after that, so most of the wait is usually the approval step. To start an order, see How to Buy a Sectigo SSL Certificate. Renewals go through the same validation, as explained in How does an SSL Certificate Renewal work?.
Issuance can take longer, or the order can be canceled, when something blocks validation or issuance. Common causes include:
- Domain misconfiguration
- CAA records preventing validation and issuance
- Problems with the approval email process
Tip
Remember to approve the certificate
In many cases, the process is delayed because the certificate request is never approved. After submitting the certificate request, monitor the approval email inbox and make sure to approve the certificate using the message sent by the Certificate Authority. It is also a good idea to check your spam folder in case the message is filtered there.
Note
Sectigo wildcard SSL certificates and CAA
If your domain has CAA records, a Sectigo wildcard SSL certificate needs Sectigo in both the issue and issuewild records, because the certificate also includes the non-wildcard name.
For example, a certificate for *.example.com also covers example.com. This means the CAA policy must allow Sectigo to issue both the wildcard and non-wildcard names:
example.com. CAA 0 issue "sectigo.com"
example.com. CAA 0 issuewild "sectigo.com"
These requirements also apply to wildcard SSL certificates for subdomains.
Let’s Encrypt certificates
For Let’s Encrypt certificates, issuance is usually faster than for Sectigo certificates, because the process is fully automated. To order one, see How to Get a Free Let’s Encrypt SSL Certificate.
Let’s Encrypt uses DNS-based validation, which DNSimple handles automatically when the domain is delegated to and exclusively resolves with DNSimple. The automated nature of this process eliminates manual approval steps and reduces issuance time.
If issuance takes longer than expected, or the certificate is not issued, common causes include:
- Domain misconfiguration: If the domain is not correctly delegated to DNSimple, or is not exclusively resolving with DNSimple, DNSimple cannot complete the DNS validation required by Let’s Encrypt.
- CAA records preventing issuance: If the domain’s CAA policy does not allow Let’s Encrypt to issue a certificate, the request will fail.
- Rate limiting: Let’s Encrypt applies rate limits to prevent abuse. If too many certificates are requested for the same domain or set of names within a short period of time, issuance may be temporarily blocked until the limit resets.
Have more questions?
If you have additional questions or need any assistance with certificate issuance timeframes, just contact support, and we’ll be happy to help.