Automation failures in Coolify SSL deployments

Network and DNS roadblocks

The Cloudflare proxy is the single most common reason for failure. When the orange cloud setting remains active, Cloudflare intercepts traffic and prevents Let’s Encrypt from reaching the Traefik server to verify the domain. This interference prevents the validation of the domain via port 80. If you have both IPv4 and IPv6 records, Let’s Encrypt checks both. A misconfigured AAAA record where port 80 remains closed will cause the entire challenge to fail. You know the basics of reverse proxying, so verify that your firewall allows traffic on port 80 and port 443. If port 80 remains closed, the HTTP challenge fails entirely. To fix this, you can briefly switch Cloudflare to DNS only mode to allow the certificate to issue. If the A record or AAAA record points to the wrong IP address, the DNS validation fails because the Let’s Encrypt server cannot find the unique token placed on your server via port 80. A Web Application Firewall might also block Let’s Encrypt with a 403 error. Some users experience issues where Traefik 3.6.2 uses a self-signed certificate instead of the expected certificate from cert-manager when moving from experimental to stable settings.

Certificate file and wildcard errors

Custom certificate uploads often fail because of incorrect file extensions or directory placement. Users must place files in the /data/coolify/proxy/certs/ directory. The certificate file must end with .cert and the key file must end with .key. If a provider provides files in .pem format, you must rename them to the required extensions. A mismatch in the Common Name also prevents certificate functionality. An expired certificate may persist if the proxy continues to use the acme.json file. You can resolve this by deleting the acme.json file from the /data/coolify/proxy directory and restarting the proxy via the dashboard. Wildcard certificates specifically require the DNS-01 challenge because Let’s Encrypt refuses to issue them through HTTP-01. You must provide correct API credentials for your DNS provider. If your custom certificate is missing the intermediate CA chain, browsers will show a "Certificate signed by unknown CA" warning. For subdomains, you must list both the apex and the www variant in the Domains tab, such as https://example.com, https://www.example.com. Wildcard certificates covering *.example.com will not cover sub-subdomains like foo.app.example.com. Does the container restart always clear the cache? Coolify’s SSL automation fails without precise network and DNS alignment.

Let’s Encrypt rate limit constraints

Let’s Encrypt imposes strict limits that stop automated renewals. If you repeatedly attempt to issue certificates with broken configurations, you hit the "too many failed authorizations" limit. This lockout lasts for one hour per identifier. If you hit the limit for a registered domain, you must wait for the capacity to refill, which occurs at a rate of one certificate every 202 minutes. One common mistake involves reinstalling the client or deleting configuration data repeatedly while troubleshooting. This behavior consumes your allotted requests. If you hit the 50 certificates per registered domain limit, you cannot bypass it without an official override. You can bypass some limits by adding a new subdomain to create a new certificate. A 429 error indicates that Let’s Encrypt has rate-limited the server IP address. This can happen if you use a shared IP address. If you hit the limit for an exact set of identifiers, the refill rate is one certificate every 34 hours.