Why won't my custom subdomain CNAME or SSL validate?

If a custom subdomain CNAME won't authorise, or the cert won't validate or parse, work through these

If a custom subdomain CNAME won't authorise, or the cert won't validate or parse, work through these:

1

Both CNAME records must be present and correct: the ACM validation record and the load balancer record. On some DNS providers, omit the domain suffix from the record name since they auto-append it. Verify with a DNS lookup tool that the record resolves before SSL can be issued.

2

The CNAME must be DNS only (grey cloud, proxy off), not proxied through Cloudflare. Otherwise SSL terminates at Cloudflare's edge and Terra's cert can't be served.

3

Keep the certificate-validation CNAME from support permanently in DNS. It is used for ongoing SSL renewal, and removing it breaks long-term connectivity.

4

If the subdomain serves a cert whose CN is an unrelated domain, it is still valid as long as your subdomain is in the Subject Alternative Names. Modern TLS matches against SAN, not CN, so a portal parse error then points to the URL string (trailing slash, whitespace), not the cert.

Also confirm all required scopes are selected, the redirect points to the auth path, and the webhook is set correctly.