stuck at "TLS certificate is being provisioned. This may take up to 15 minutes to complete."

[Bloho]

Select Topic Area

Question

Body

It's been a few hours after I added the custom domain, and TLS certificates are not going through. "TLS certificate is being provisioned. This may take up to 15 minutes to complete."

Like am I supposed to do something or wait it out, can't really figure it out. HELPP

[softjapan]

1. Check DNS is really pointing to Pages

dig +short CNAME www.example.com

→ should return your-project.pages.dev.

2. Check no stray A/AAAA records

dig +short A www.example.com
dig +short AAAA www.example.com

→ should be empty.

3. If using Cloudflare DNS → make sure the CNAME is proxied (orange cloud).

4. Check CAA records (only needed if you added them):

dig +short CAA example.com

→ allow letsencrypt.org or remove them.

5. Final test (resolve from public DNS)

dig www.example.com @1.1.1.1
dig www.example.com @8.8.8.8

If all looks good and it’s still stuck, remove the custom domain in Pages and re-add it — that usually forces a new cert request.

[redoper1]

For example I had to disable proxying in the CF DNS for my subdomain for GH to be able to generate certs.

Before I did this it was stuck on step 1/3 with this error: Certificate Request Error: Certificate provisioning will retry automatically in a short period, please be patient.

[Bloho]

It went through after a few hours, didn't had to do anything extra. But thanks for the idea!

[suraweera-AGSS]

Hi @Bloho,

When you see “TLS certificate is being provisioned. This may take up to 15 minutes to complete.”, it usually means GitHub is still validating your DNS settings before issuing the certificate. A few key things to check:

1. DNS Records
   • For a root domain (example.com), use an A record pointing to GitHub’s IPs:
     185.199.108.153
     185.199.109.153
     185.199.110.153
     185.199.111.153
   • For a subdomain (www.example.com), use a CNAME record pointing to <username>.github.io.
2. Propagation Time
   • DNS changes can take a few hours (sometimes up to 24h) to propagate globally. Even if GitHub says “15 minutes,” it often depends on DNS caches.
3. Enforce HTTPS
   • In your repo’s Pages settings, ensure “Enforce HTTPS” is checked after the certificate is active. Sometimes you need to refresh or wait a bit before the option appears.
4. Clear Cache / Restart Browser
   • After GitHub shows the certificate is active, if you still see a privacy error, clear your browser cache or try an incognito window.

If Still Stuck:
try:-
• If it’s been more than 24 hours and it’s still stuck, try removing the custom domain from your repo settings, wait 10–15 minutes, and re-add it.
• If the issue persists, open a ticket with GitHub Support: https://support.github.com/contact

[Bloho]

I just waited a few more hours, and it went through!

[suraweera-AGSS]

Nice

[suraweera-AGSS]

🔗 GitHub Support: https://support.github.com/contact

Contact No: (877) 448-4820