A Trustico® SSL Certificate license lets you obtain SSL Certificates throughout its term, not only once. Each SSL Certificate is issued after validation confirms you are entitled to it, whether it is your first SSL Certificate or a later reissue.
Sometimes a reissue cannot be completed because validation does not pass. This page explains why validation is needed every time, what happens when it cannot proceed, and the domain name or server changes that most often prevent an SSL Certificate from being issued.
Your License and Your SSL Certificate
Two things are easy to confuse here. The license is what you hold. The SSL Certificate is what the Certificate Authority (CA) issues to you under that license once validation has been met.
A single license can produce more than one SSL Certificate during its term. You might reissue to replace a current SSL Certificate, or request an additional SSL Certificate for another server. While the license is in compliance, those issuances remain available to you.
A validation that does not pass has no effect on the license. It stays valid and in force, and the reissue can be completed later once the requirements are met. Learn About What Your Purchase Covers 🔗
Validation Proves Your Eligibility
Validation is how the Certificate Authority (CA) confirms that whoever requests an SSL Certificate is entitled to one for the domain name concerned. It is the proof of eligibility, and it applies to every issuance rather than once at the start.
When you reissue, the Certificate Authority (CA) performs that check again. Passing it shows that you still control the domain name and, for Organization Validation (OV) and Extended Validation (EV) SSL Certificates, that your organization details are still correct. Only then is the SSL Certificate issued.
If the validation requirements are not met, no SSL Certificate is issued. A valid license does not change that outcome. Validation and the license are separate gates, and both have to be satisfied before an SSL Certificate can be produced. Discover The Validation Procedure 🔗
When You Would Reissue
A reissue produces a fresh SSL Certificate under your existing license. Two situations account for most reissues, and in both the responsibility for completing the process rests with the license holder.
The first is replacement. You would reissue if your Private Key is lost or compromised, if you move to a different server, or if a configuration change calls for a new SSL Certificate. A reissue creates a new key pair, because Trustico® does not keep a copy of your Private Key.
The second is an additional SSL Certificate. You may need another copy for a second server, or a further SSL Certificate covered by the same license. Each one is still issued only after validation has been met. Learn About Reissuing Your SSL Certificate 🔗
When Validation Cannot Proceed
If validation cannot be completed, the reissue stops there and no SSL Certificate is issued. This is not a fault with the SSL Certificate or the license, and it is not a basis for a refund.
The ability to reissue is a feature of holding a license, not a payment toward a guaranteed result on any single attempt. The cost of each SSL Certificate is covered by the license you already hold, and a validation that does not pass does not consume or reduce it.
Important : A reissue that cannot be validated does not result in a refund. The license remains valid, and the reissue can be completed once the validation requirements are met.
The onus is on the license holder to carry out the reissue and work through its requirements successfully. Where a validation step keeps failing, the cause is usually something in the domain name or server configuration that can be corrected and tried again.
Other Reasons an SSL Certificate May Not Be Issued
Validation is the most common gate, but it is not the only one. A Certificate Authority (CA) runs several checks at the moment of issuance, and any one of them can stop an SSL Certificate from being issued even when your order details look complete.
Certification Authority Authorization (CAA)
Certification Authority Authorization (CAA) is a Domain Name System (DNS) record that lists which Certificate Authorities are permitted to issue SSL Certificates for your domain name. The Certificate Authority (CA) reads it at the point of issuance.
If a Certification Authority Authorization (CAA) record has been added or edited so that it no longer permits the issuing Certificate Authority (CA), the request is refused. A reissue that succeeded before can fail for this reason if the record changed in the meantime.
Multi-Perspective Issuance Corroboration (MPIC)
Multi-Perspective Issuance Corroboration (MPIC) is a check in which the Certificate Authority (CA) confirms your domain control from several network locations rather than a single one. It is designed to detect localized interference with the validation process.
If your domain name resolves differently depending on where the request originates, or a recent change has not settled everywhere yet, Multi-Perspective Issuance Corroboration (MPIC) can fail. Geographically restricted Domain Name System (DNS), firewall rules that block some regions, and very recent record changes are common causes.
Changes Since Your Last Issuance
Most reissue problems come down to something that changed since your SSL Certificate was last issued. A validation method that worked at the time may no longer be in place.
Moving to a new Domain Name System (DNS) provider, changing nameservers, or editing records can remove the proof the Certificate Authority (CA) expects to find. Where a file is used for validation, it must still be reachable, and when an SSL Certificate covers both the root and www names, the file has to exist at both.
The approver e-mail method has changed across the industry as well. Only the five standard addresses, or a validation contact published in a Domain Name System (DNS) record, are now accepted, so an older approver address may no longer work.
Domain name status matters too. A registration that has lapsed, a registry or registrar hold, or a recent transfer can each stop issuance until the domain name is back in good standing.
Completing a Reissue Successfully
Most failed reissues can be completed on a second attempt once the underlying cause is corrected. The steps are straightforward, although they take a little time to take effect.
Start by confirming which validation method your reissue uses, then check that the matching proof is in place.
For Domain Name System (DNS) validation, confirm the record exists and has propagated. For file-based validation, confirm the file is reachable at every name the SSL Certificate covers. For e-mail validation, confirm the approver address is one that is accepted.
Tip : Begin a reissue well before your current SSL Certificate expires. Validation, Domain Name System (DNS) propagation, and the Certificate Authority (CA) checks all take time, and an early start leaves room to correct anything that does not pass on the first attempt.
Allow time for Domain Name System (DNS) changes to propagate and for the multi-perspective checks to agree before you try again. If a step keeps failing after that, a specific requirement is still outstanding and needs to be resolved.
Diagnosing a Failed Reissue
When a reissue will not complete, the onus is on you to work out where the requirements are not being met. Start by reviewing the relevant pages on our website and confirming that every validation requirement has been satisfied.
If a server or Domain Name System (DNS) change is involved, raise it with your IT department or team, who can check your configuration against what the Certificate Authority (CA) expects.
These failures usually come down to a Certification Authority Authorization (CAA) or Multi-Perspective Issuance Corroboration (MPIC) problem.
A sensible first step is to use one of the online Domain Name System (DNS) lookup tools to confirm that your records have propagated, that the Time To Live (TTL) has passed, and that your Domain Name System (DNS) answers from around the world.
Global reachability matters whether or not a Certification Authority Authorization (CAA) record is in use, because the Certificate Authority (CA) has to resolve your domain name consistently from every location it checks. A Domain Name System (DNS) that responds in some regions but not others will stop issuance.
A misconfigured Domain Name System Security Extensions (DNSSEC) setup will also prevent issuance. If you have it enabled, confirm that it validates correctly before you try the reissue again.
If an approver e-mail does not arrive, that is outside anything Trustico® can see, because we have no insight into your mail environment. Review your mail server logs or speak with your mail provider, and make sure the chosen approver address can receive external e-mail.
Active Management Has Become Essential
Industry regulations have tightened in recent years. Validation now has to pass for every issuance, SSL Certificate lifetimes are getting shorter, and the checks a Certificate Authority (CA) runs are stricter than they once were.
Because of this, keeping a website secure is no longer a set-and-forget task. It calls for hands-on management of your online presence and security, including your domain name, your Domain Name System (DNS), and the validation requirements that each issuance depends on.
This applies whether you use a traditional SSL Certificate or Certificate as a Service (CaaS). Automation handles the issuance for you with Certificate as a Service (CaaS), but your environment still has to be correct, because an automated request fails just as a manual one does when a requirement is not met.
Wildcard
Wildcard
Wildcard
