> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/faq/help-topics/something-else/custom-subdomains-ssl-and-security/cname-validation-ssl-issuance-troubleshooting.md).

# Why won't my custom subdomain CNAME or SSL validate?

If a custom subdomain CNAME won't authorise, or the cert won't validate or parse, work through these:

{% stepper %}
{% step %}
**Both CNAME records must be present and correct**: the ACM validation record and the load balancer record. On some DNS providers, omit the domain suffix from the record name since they auto-append it. Verify with a DNS lookup tool that the record resolves before SSL can be issued.
{% endstep %}

{% step %}
**The CNAME must be DNS only** (grey cloud, proxy off), not proxied through Cloudflare. Otherwise SSL terminates at Cloudflare's edge and Terra's cert can't be served.
{% endstep %}

{% step %}
**Keep the certificate-validation CNAME from support permanently in DNS.** It is used for ongoing SSL renewal, and removing it breaks long-term connectivity.
{% endstep %}

{% step %}
If the subdomain serves a cert whose CN is an unrelated domain, **it is still valid as long as your subdomain is in the Subject Alternative Names**. Modern TLS matches against SAN, not CN, so a portal `parse` error then points to the URL string (trailing slash, whitespace), not the cert.
{% endstep %}
{% endstepper %}

Also confirm all required scopes are selected, the redirect points to the auth path, and the webhook is set correctly.