Staging Site SSL Improvements

slimx

When deploying a staging site, I find that SSL issueing takes abnormally long. It has a self-signed and then i manually hit Let's Encrypt and it does it instantly of course.

Is there a more streamline way of fixing this? A setting I am missing? My staging domain is linked my main nameservers, so im unsure of how i can control it further

Vortex

slimx same.. almost none of my stagings have a ssl issued 2 months now

ivansalloum

Vortex Did you add your staging domain as a blank site as the owner with SSL certificate installed?

adil

Did you try to add your Staging Domain as a website first ?

slimx

adil
ivansalloum
It is added as a website. I actually thought having a separate domain for staging sites would help, but it all seems to be the same 🙁

WebInfra
I think the wildcard SSL would be the best way to go.

Adam
Yeah I see, most probably that bit of a delay is because it's waiting for the new record to fully propagate. Surely there's a way to solve this with just have a * wildcard ssl or something?

WebInfra

There is a planned feature for wildcard SSL from Let's Encrypt, and that should resolve this issue as well:
https://community.enhance.com/d/844-lets-encrypt-max-request-failure

No idea on when they will actually roll it out though.

XN-Matt

Yes, we've seen this happen too. Many times. It often isn't until we manually request when it applied.

Adam

The staging suffix needs to have its own DNS zone since Let's Encrypt will look for the presence or absence of a CAA record. If this fails they will refuse to issue an SSL for the subdomain. If the nameservers are delegated to your Enhance cluster, adding it as a website is the easiest way. If it's using external DNS, you should create the zone there.

Automatic SSLs are processed in a queue and only when your server detects that the DNS is pointed correctly. It can be that your server's DNS resolvers cache an NXDOMAIN response before the DNS is ready. Requesting the SSL manually via the "security" tab overrides this check and allows the SSL to be issued instantly.