GitHub Pages : stuck with "Certificate Request Error"

[server-KaTys]

Hello,

I have deployed GitHub Pages from the server-KaTys/status at the status.katys.cf custom domain, which used to work, but is stuck with a Certificate Request Error for weeks now.

The dig status.katys.cf +noall +answer -t A command outputs :

status.katys.cf.	3600	IN	CNAME	server-katys.github.io.
server-katys.github.io.	3600	IN	A	185.199.111.153
server-katys.github.io.	3600	IN	A	185.199.108.153
server-katys.github.io.	3600	IN	A	185.199.109.153
server-katys.github.io.	3600	IN	A	185.199.110.153

But, Pages settings indicate :

Regarding similar discussions :

• Certificate request error is persistent (TLS Certificate can't be provisioned) #22052 and TLS Certificate Request Error #23372 were caused by a missing CNAME record, which is present in my case ;
• Certificate Request Error #23410 was caused by DNSSEC, but I don't have that feature ;
• HTTPS for Custom Domain - Certificate Request Error - never resolves #22811 was resolved by itself the next day, while I'm experiencing an issue for weeks.

I also deployed GitHub Pages from server-KaTys/KaTys at katys.cf, which works perfectly.

Thanks.

PS: this is a machine user (GitHub Docs, section Personal accounts, § 4). Further replies will be submitted from @KaKi87.

[queenofcorgis]

Moving this into our Pages category for better visibility - @yoannchaudet would you mind taking a look please?

[KaKi87]

Hello,

The person you mentioned was already on vacation when you did, and still is today, would it be possible to please ask someone else who would be available ?

Thanks.

[yoannchaudet]

Hello there,

I don't see anything wrong with your DNS configuration now. DNS propagation is not an exact science and this could have tripped the initial certificate request. I just kicked the process again and your cert was issued. It will take up to 10 minutes to show up everywhere in our CDN.

Cheers,

[KaKi87]

It now works fine, thanks !
Would it be possible to allow end users to trigger that process restart ?
I think many people would gain much time from this.
Thanks

[yoannchaudet]

It is actually automatic anytime you access the Pages settings for your repo.

[KaKi87]

When opening DevTools, I indeed spotted that request performed every X seconds, but it has never done anything even when letting it run for hours.
Thanks

[holtzy]

Hi @yoannchaudet.

I'm facing exactly the same issue as @server-KaTys. I read the same doc/post/discussion and made the same conclusion.

Any chance you could look at my setup and re-trigger the SSL certificate pipeline for me too?
https://github.com/holtzy/The-Python-Graph-Gallery/settings/pages

I'm truly desperate with all my traffic being stopped 😔

Dig for www.python-graph-gallery.com

And for python-graph-gallery.com

Thanks!

[KaKi87]

Hello, currently your site seems to work fine. ^^

[holtzy]

Thanks @KaKi87.
I was so desperate that I moved to Vercel. But I would really like to be back to GitHub pages if I find a way to resolve my issue..

[ossikoski]

Hey @yoannchaudet @KaKi87 , I'm having same kind of issues.

I got it to work already this week, but after making some changes with just the content of the website, I cannot get TLS certificate or not even the DNS check to complete. I have checked DNS settings of my provider, github pages settings etc. and everything should be as before back when it worked. The odd thing, when I click "check again", I get a message saying "Certificate already exists for www.kaivomies.fi in state 'bad_authz'. Resuming the process." I cannot find anything about that.

Any help is appreciated, thank you!

[yoannchaudet]

https://www.kaivomies.fi has a cert and works fine.

I highly suggest you also point kaivomies.fi at GitHub Pages. This will give you a new certificate but it would be more "web" friendly.

[ronskoro]

Hi, I have been trying for several days now to solve the same certificate request issue. Could you also create a new SSL certificate for me please?
I am in the organization Theis-lab and the project is archmap. I want to configure www.archmap.bio to work with GIthub Pages.

[natefillups]

How did you end up getting this fixed?

[lealceldeiro]

Same issue happening for me. 2024-04-21 :(

[LiteBrite82]

have you tried what worked for these folks? https://github.com/orgs/community/discussions/57680

[LiteBrite82]

https://github.com/orgs/community/discussions/37200

[lealceldeiro]

have you tried what worked for these folks? https://github.com/orgs/community/discussions/57680

Hey, @LiteBrite82 ,

Indeed, setting my Cloudflare DNS records to proxy only worked.

Thanks for following up 👍

[wonder-sk]

I have started to have this "Certificate Request Error" problem in a repository that previously worked fine for a few months (https://github.com/qgis-sk/uc2024-web), but a couple of days ago the certificate has expired, and was not refreshed since.

DNS check passes fine...

I have also tried to remove the custom domain and add it back (twice), but with the same error:

(this message stays the same for hours)

Checked with letsdebug.net and things seem fine there: https://letsdebug.net/uc2024.qgis.sk/1899521

I am not sure what else should I try to get the certificates working again...

[DorianMazur]

I think it would be helpful to have more details related to the certificate generation error. Because now it's a black box. I'm sure the DNS are set correctly and even github checks them correctly, but for some reason the certificate hasn't been created for 10 days now...

[LiteBrite82]

@DorianMazur
Im assuming you tried these trouble shooting steps: Securing your GitHub Pages site with HTTPS

[yoannchaudet]

@wonder-sk

You have an extra CNAME that should not be here:

You have to pick, either A records or a CNAME. Not both. This is what's preventing your certificate from being obtained.

[wonder-sk]

@yoannchaudet thanks a lot for the hint! I have updated the uc2024.qgis.sk domain config so that it uses A records instead of CNAME ... and it looks like the certificates finally got refreshed 🎉

A couple of confusing bits you may want to address at Github Pages:

• my domain uc2024.qgis.sk did not use both CNAME and A records. It only used one CNAME record, as you can see in your output from dig - the A entries were for the qgis.sk domain (I am using qgis.sk domain with github pages from another git repo)

• with the original configuration (using CNAME), the setup worked fine for a couple of months (since January 2024), but then the certificate failed to renew, without any change in my DNS configuration

• with the original configuration, I was getting "DNS check successful", making me think there's nothing to worry about my DNS setup. With the new configuration (using A records), github tells me there's a problem, yet now the certificate got renewed:

  

For the record, this is the new DNS config for the domain:

[yoannchaudet]

I misread the output of the command! Sorry for that.

We will relax some validation logic but at the moment, a CNAME will only be allowed if it points to <user or org name>.github.io. Like we document in https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/managing-a-custom-domain-for-your-github-pages-site#configuring-a-subdomain.

[Zesaa]

Thanks