How To Fix a Failed Free SSL Certificate in xCloud
Updated November 2, 2026 · 5 min read
If your site’s SSL certificate failed, open the site’s SSL/HTTPS page and click Retry SSL. If the status goes back to Failed, something is stopping the certificate from being issued. Common causes are your DNS records, the Cloudflare proxy or a closed port 80. Fix that, then click Retry SSL again.
This guide covers the free SSL certificate issued and managed by xCloud, and has a separate section for Cloudflare-managed SSL. Start with these steps before you reinstall anything or contact support.
Step 1: Open the SSL/HTTPS page and check the status
Open your site in xCloud, then go to Domain → SSL/HTTPS in the site menu.
Look at the certificate’s Status column. Failed means the last attempt did not issue a certificate, even if the page shows no other warning.
You may also see a red banner at the top of the page that says SSL certificate installation failed. If your team uses the To-Do list, you see a single line instead, such as 1 thing needs attention on this site. Click Review on that line to open the list. The item says SSL failed on 1 site, and clicking the site’s name opens SSL/HTTPS.
Step 2: Click Retry SSL
Leave Use free SSL certificate issued & managed by xCloud selected and click Retry SSL at the bottom of the page.
xCloud shows Updating SSL certificate. It will be reflected in a while. and the certificate details are hidden while xCloud works on it. When it succeeds, the status changes to Obtained or Installed. If the red banner is still there, refresh the page.
If the status returns to Failed, clicking again won’t help until the cause is fixed. Go to Step 3.
Step 3: Check your DNS, Cloudflare proxy and port 80
Let’s Encrypt, the service that issues the free certificate, has to reach your domain over the internet to confirm that you control it. Check each of these:
| Check | What it should look like |
|---|---|
| A record | The domain points to your server’s IP address. You can see the IP address at the top of the site’s page in xCloud. |
| Every hostname | Every name listed under Hostnames points to your server. If www.example.com is on the certificate, it needs its own record too. If one name doesn’t point to your server, the whole certificate fails. |
| IPv6 records | The domain has no AAAA (IPv6) records at your DNS provider. |
| Cloudflare proxy | If your DNS is on Cloudflare and you use the free xCloud certificate, set the record to DNS only (grey cloud) until the certificate is issued. |
| Port 80 | Port 80 is open on your server and in any firewall at your cloud provider, so Let’s Encrypt can reach your site. |
To check the records from your own computer, turn the Cloudflare proxy off (DNS only) if you use it, because while it’s on these commands print Cloudflare’s IP addresses. Then run them with your domain:
dig +short A example.com
dig +short AAAA example.comIn the first command’s result, the last line should be your server’s IP address, and no other IP address should appear. The second command should show no IP address. If a name points to another name, that name is printed first, which is fine. Run them again for every name under Hostnames, such as www.example.com.
A tool such as DNS Checker shows the same records from different locations, which helps when you have just changed them and they are still spreading.
Next, check port 80. With the Cloudflare proxy off (DNS only), run this command. Any HTTP response, even a redirect, means the port is reachable:
curl -I http://example.comWhile the proxy is on, the answer comes from Cloudflare, so you get a response even when port 80 on your server is closed. A 522 error is one example.
If the curl command times out with the proxy off, port 80 is closed. Follow How to Fix Cloudflare 522 Errors When Ports 80 and 443 Are Closed, which shows how to open the ports.
Step 4: Retry SSL again
After you fix the cause, go back to SSL/HTTPS and click Retry SSL. If you changed DNS records, give them time to spread first, because a retry made too early fails in the same way.
Once the status shows Obtained or Installed, you can turn the Cloudflare proxy back on if you use it. We recommend setting Cloudflare’s SSL mode to Full (strict). As of November 2026, Cloudflare’s Full (strict) documentation accepts a certificate from a publicly trusted authority. The free certificate is publicly trusted, so Cloudflare can validate it.
If you use Cloudflare-managed SSL
If Use Cloudflare managed SSL Certificate is selected, the certificate comes from your connected Cloudflare account, so the checks are different. Keep that option selected, fix the cause, and click Retry SSL.
- If the banner says your Cloudflare integration does not have permission to issue certificates, give your Cloudflare API token the Zone → SSL and Certificates → Edit permission, then use the update your Cloudflare integration link in the banner. The To-Do list doesn’t show this banner, so if your team uses it, check the permission on your token and go to Settings → Integrations → Cloudflare to update it. Using xCloud with Cloudflare shows how to update the token.
- If the error says No cloudflare account found for this domain, the domain isn’t in the Cloudflare account you connected to xCloud. Add it to that account or connect the right one. With several domains, the error says The following domains are not found in your Cloudflare account and names them, or Some domains are not valid. The fix is the same.
Don’t switch to the free certificate just to clear this error, because the switch doesn’t fix the token or the account. Switch only if you no longer want a Cloudflare certificate. To do that, select Use free SSL certificate issued & managed by xCloud and click Save. xCloud turns off the Cloudflare proxy for the domain while it gets the new certificate, and you can turn the proxy back on afterwards.
If a switch to a new provider fails and an earlier certificate still works, xCloud moves the site back to that certificate so HTTPS keeps working. If SSL/HTTPS shows a different provider than the one you just chose, this is why.
Other cases
- Demo sites: xCloud manages the SSL on demo sites, so there is no provider to choose. When the banner says Demo site SSL certificate failed to install, click Retry SSL on the banner itself and confirm. Your site may have brief downtime while the certificate is reinstalled. If your team uses the To-Do list, this banner isn’t shown, and neither the list nor the SSL/HTTPS page of a demo site has a retry button, so contact our support team.
- WordPress Multisite with subdomains: these sites use a wildcard certificate with DNS TXT records. If xCloud can’t find the TXT records yet, check them and click I’ve Added the Records again. If the challenge fails, the button says Retry Challenge. See WordPress Multisite with subdomains.
- Retry SSL keeps failing and your DNS is correct: you can reinstall the certificate. On SSL/HTTPS, turn off the HTTPS Is Enabled switch and confirm with Yes, disable it!. Then turn the switch back on, select the free certificate and click Save. Your site has no HTTPS during this time, so try it only after the steps above.
If your browser still shows a security error
If the status is Obtained or Installed but you still see ERR_SSL_PROTOCOL_ERROR or NET::ERR_CERT_AUTHORITY_INVALID, your browser may be holding on to an old result. Clear your browser cache or open the site in a private window.
If the error stays, check the certificate your domain is serving with an online SSL checker tool. For errors that come from inside WordPress, such as mixed content, see How to troubleshoot SSL issues in WordPress. To learn about the other certificate options, see How to enable HTTPS and configure SSL certificates.
Frequently asked questions
Does xCloud retry a failed SSL certificate on its own?
For a renewal, yes. xCloud retries about every 12 hours at first, then less often if the certificate has been expired for more than 3 days, and it stops after 30 days. After that, the status shows Renewal Required and the button says Save. Fix the cause and click Save to try again. Until then, you don’t have to wait: click Retry SSL once the cause is fixed. The exception is the wildcard certificate on WordPress Multisite with subdomains, which you renew yourself on SSL/HTTPS. For a certificate that has never been issued, open SSL/HTTPS and click Retry SSL yourself. The SSL/HTTPS page may say it will retry in 12 hours. Don’t wait for that on a new certificate: click Retry SSL.
Why does the button say Save instead of Retry SSL?
The button says Retry SSL only while the certificate provider you originally chose is selected and the status is Failed. If you pick a different option on the page, the button changes to Save, because saving switches the provider. The button also says Save when the status is Renewal Required.
My Cloudflare-managed SSL failed. Should I switch to free SSL?
Not as a first step. Fix what the error names, such as the API token permission, and click Retry SSL with Cloudflare still selected. Switch to free SSL only if you no longer want a Cloudflare certificate.
If you run into any issues with your SSL certificate, feel free to reach out to our support team.