> For the complete documentation index, see [llms.txt](https://docs.tryterra.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.tryterra.co/help-center/help-topics/something-else/custom-subdomains-ssl-and-security/cname-validation-ssl-issuance-troubleshooting.md).

# Why won't the certificate for my custom subdomain issue or go live?

The certificate is issued once the DNS record shown in the dashboard resolves exactly as given, with no proxy in front of it and no CAA record blocking Terra's certificate authority.

**The certificate is issued once the DNS record shown in the dashboard resolves exactly as given, with no proxy in front of it and no CAA record blocking Terra's certificate authority.** Terra issues and renews the certificate for you, so a subdomain set up from the dashboard needs no validation record. If your subdomain was set up earlier with support, keep its validation record in place.

The setup runs in the provider's connection settings on the Connections page, for providers such as WHOOP and Dexcom that use your own developer app on your own subdomain. The status under the DNS step tells you where it is stuck:

* **Waiting for DNS**: Terra can't see the record yet. DNS changes can take from a few minutes to a few hours to propagate. You can close the window and come back without losing progress.
* **Issuing certificate**: the record was found and the certificate is being issued. This usually takes a couple of minutes.
* **Your DNS blocks our certificate authority**: see the CAA step below.
* **Live**: the subdomain is serving and you can continue to the provider app step.

If it stays on Waiting for DNS or fails, work through these:

{% stepper %}
{% step %}
**Add the record exactly as shown**, with the type, name and value from the dashboard. If your DNS provider appends your domain to the name automatically, enter only the prefix (for example `whoop`), otherwise the record ends up on a doubled name such as `whoop.yourdomain.com.yourdomain.com`. Check with a DNS lookup tool that the full subdomain resolves.
{% endstep %}

{% step %}
**Turn off proxying for the record.** On Cloudflare that is the orange cloud. While it is on, the record points at the proxy instead of Terra and the certificate can't be issued.
{% endstep %}

{% step %}
**Allow Terra's certificate authority if your domain has CAA records.** Ask your DNS admin to allow Google Trust Services (`pki.goog`). Setup picks it up automatically once the record is in place.
{% endstep %}

{% step %}
**Use a different subdomain** from the DNS step if you entered the wrong one. Reopening the window resumes where you left off, so this button is the way to start again.
{% endstep %}
{% endstepper %}

A subdomain already set up on another of your environments is reused with no DNS change needed.

Once the subdomain is live, the dashboard shows the values to paste into the provider's developer portal, then the credentials form. The redirect URL is filled in from your subdomain. See the [WHOOP](https://docs.tryterra.co/unified-api/whoop) and [Dexcom](https://docs.tryterra.co/unified-api/dexcom) setup guides.