An SSL certificate stuck in “Pending” status is a fixable technical hurdle caused by the Let’s Encrypt automated system receiving conflicting signals from your DNS records. Because the system detects multiple paths for your domain, it cannot confirm ownership with certainty. Resolving these DNS conflicts allows the automated system to complete and issue your certificate.
To resolve this, we need to clean up your DNS configuration and remove any ambiguity. You must identify and remove extraneous AAAA records—these are often the primary cause of certification hangs. Once you have ensured that your A records point exclusively to Wix servers, go into your dashboard to re-trigger the validation process. This clears the path for the Let’s Encrypt system to verify your domain without interference.
Emergency Stop-Gap: If you need immediate verification that your site is functional while waiting for DNS propagation across the global web, create a temporary subdomain (such as
dev.yourdomain.com). This allows you to bypass primary domain conflicts and confirm that Wix’s servers are correctly configured to issue certificates.
Before You Start
You need to grab a snapshot of your current DNS settings before we begin modifying anything at your registrar. Think of this as your safety net—having these records saved ensures we can revert everything immediately if an error occurs during the transition. The following steps assume you have active login credentials for both your Wix dashboard and the administrative portal of your domain registrar (such as GoDaddy, Namecheap, or Google Domains). Do not modify any record unless you are certain it is currently incorrect.
Related guide: Webflow Custom Domain DNS Configuration
What are the symptoms of a pending SSL?
I know how frustrating these technical hurdles are when you’re just trying to get your site live. When your certificate is in a “pending” state, several things happen on the front end. Visitors to your site may see a “Not Secure” warning in their browser, or the site may fail to load entirely with a certificate error. In some cases, the Wix dashboard will display a yellow warning icon next to your domain name. This status remains until the Let’s Encrypt validation server can successfully reach your domain and confirm that it points exactly where you told Wix it should point.
Related guide: Fix Mixed Content SSL Security Errors
Why is my SSL certificate stuck in pending?
It’s incredibly frustrating to watch a site sit in “pending” status when you just want your storefront live. I’ve seen this exact hurdle hundreds of times; it usually isn’t a failure on your part, but rather a communication breakdown between your domain registrar and the certificate authority (Let’s Encrypt).
There are three specific technical roadblocks that typically cause this hang-up.
First, you likely have “zombie” records lingering in your DNS settings. Specifically, these are AAAA records—which handle IPv6 traffic. Even if you have updated your main IP addresses to point toward Wix, these old records might still be pointing toward your previous host. If Let’s Encrypt attempts to verify your site via an IPv6 address that no longer exists or points elsewhere, the certificate will stall.
Second, there is often a mismatch between your CNAME or A records and the specific IP addresses provided by Wix during the migration. For an SSL certificate to issue successfully, the “handshake” must be perfect. If your DNS records contain even one conflicting entry that doesn’t align with the Wix-provided infrastructure, the verification process will fail because the system can’t confirm exactly where your site lives.
Third, you may be dealing with standard DNS propagation latency. The global naming system isn’t instantaneous; it takes time for every server across the globe to update their “maps.” If Let’s Encrypt tries to verify your move while a portion of the internet is still looking at your old records, they won’t “see” that you’ve moved to Wix, and the certificate will remain in a pending state until the global sync is complete.
Related guide: Fix Wix Slow Page Load Performance
How do I check my current DNS records?
Before you start making changes inside your Wix dashboard, we need to confirm exactly what information is being broadcasted out to the public web. It is much easier to troubleshoot these issues once we can see exactly what the internet sees. You can use an online scanner like whatsmydns.net or, if you have access to a terminal window, use the dig command to see if your domain has any hidden IPv6 records.
To check for A records:
dig yourdomain.com +shortTo check specifically for AAAA (IPv6) records:
dig yourdomain.com AAAA +shortIf that second command returns any IP addresses, those are the specific records likely causing the conflict. Let’s Encrypt often fails to issue certificates when it detects a mix of IPv4 and IPv6 addresses that do not match your target destination.
How do I fix conflicting AAAA records?
It is frustrating when a simple SSL setup stalls out due to backend configuration errors, but this specific issue is common and straightforward to resolve once we pinpoint the conflict. The problem usually stems from AAAA records—these are IPv6 addresses that your registrar may have automatically generated or left over from a previous hosting provider. When these exist, they create a split path for traffic; if they point to an old server, they will actively block the Let’s Encrypt certificate from validating on your current Wix site.
To resolve this, you need to access the DNS management console provided by your domain registrar (the company where you purchased your domain name). Navigate to the DNS zone editor and locate all records labeled as “AAAA.” You must delete every entry of this type entirely.
By removing these, your site will rely exclusively on IPv4 (A records) for its traffic. This simplifies the handshake process required by Let’s Encrypt, allowing the certificate to issue without interference. Once you have deleted the AAAA records, do not attempt to re-verify immediately. Wait at least 30 minutes for the global DNS servers to update before checking the status again in your Wix dashboard.
How do I verify my A records are correct?
I understand how frustrating it is when your website isn’t loading correctly for your visitors. It’s a high-stress situation, but this specific issue—incorrect DNS records—is something we can fix systematically.
The “A” record acts as the primary map for your domain; it tells the internet exactly which server to look at when someone types in your address. To ensure every visitor reaches your site, your “A” records must point exclusively to the specific IP addresses provided by Wix during your connection setup.
If you have multiple “A” records listed for a single host, it creates what we call a “split-route” scenario. This means your domain is essentially giving out two different directions at once; some users will successfully reach your site, while others will hit an error page or a blank screen because their browser was directed to the wrong IP.
Verify that your DNS configuration matches this exact structure:
| Record Type | Host/Name | Value (Example) | Requirement |
|---|---|---|---|
| A | @ | [Wix Provided IP] | Must point only to Wix |
| A | www | [Wix Provided IP] | Must match the ’@’ record |
| CNAME | www | yourdomain.com | Optional if A records are set |
How do I force Wix to re-issue the certificate?
Your site isn’t going anywhere, but I know how frustrating it is to see that “pending” status hanging over your head when you’ve already confirmed your DNS records are correct. This specific issue usually happens because the Let’s Encrypt verification process is stuck in a cache loop; the system hasn’t triggered a new check despite your updates.
To resolve this, we need to manually force Wix to re-initiate the connection. By briefly disconnecting and reconnecting the domain, you force their servers to perform a fresh handshake with the certificate authority.
- Go to Settings > Domains in your Wix dashboard.
- Select the specific domain that is currently stuck in “pending” status.
- Choose the option to disconnect or “Remove.” Note: This action only breaks the link between your registrar and Wix; it does not delete the domain from your actual registrar account.
- Wait 5 minutes for the system to register the change.
- Re-add the domain using the instructions provided by the dashboard.
Executing these steps forces the system to start a brand new handshake with the certificate authority, which should clear the cache and finalize your SSL status.
Why is my site still showing an error after I changed the records?
It is incredibly taxing to watch a site remain offline after you have already performed the necessary updates. There is a specific technical reason for this delay that we can track. DNS propagation isn’t an instantaneous event; it is a gradual rollout across the global internet infrastructure. When you update an A record at your registrar, that change must travel through multiple root servers and various ISP caches before it is recognized everywhere. This process typically takes between 12 and 48 hours to fully resolve. If you made the change within the last hour, the Let’s Encrypt server may still be seeing the “old” path.
To monitor whether propagation is occurring, use a tool like whatsmydns.net to view results from different geographic locations. If that tool shows your new IP in some regions but not others, it means the network hasn’t synchronized yet. You must wait until the records are consistent globally before the SSL will move out of pending status.
What are common mistakes that make this worse?
One of the primary reasons these issues persist is the presence of “ghost” records in your DNS configuration. For instance, if you have an A record for @ and a separate A record for www, but they point to different destinations, the certificate will fail because it cannot verify both endpoints simultaneously. Another common pitfall involves having a CNAME and an A record competing for the same subdomain; specifically, if both a CNAME for “www” and an A record for “www” exist at once, the server won’t know which path to take, causing the validation to break.
Additionally, you must avoid switching your nameservers multiple times in a short window. Every time you flip those settings, the TTL (Time to Live) cache is reset. This effectively restarts the clock on how long it takes for the global network to recognize your updates and allow the SSL certificate to validate. Constant changes just keep moving the finish line further away.
When should I call a professional?
I know how incredibly frustrating it is to stare at a “pending” status while your business stays offline. There are specific technical roadblocks where the issue moves beyond standard troubleshooting and into infrastructure layers that require specialized tools to untangle. You should reach out to a specialist if you hit any of these three walls:
- You have successfully purged every AAAA record from your configuration, but the “pending” status remains stuck after 48 hours of consistent DNS results. At this point, the issue usually isn’t your settings—it’s an upstream caching problem that requires a manual push.
- Your registrar has provided a “locked” DNS zone. If the interface physically prevents you from manually deleting or modifying conflicting records, you need someone with the authority and tools to bypass those restrictions at the registrar level.
- You are navigating a complex setup involving a third-party DNS provider (such as Cloudflare) and you’ve hit a stalemate where their proxy settings are clashing with Wix’s specific requirements.
In these scenarios, a professional can perform a deep trace of your entire DNS path. They won’t just look at your dashboard; they will hunt down exactly where in the chain an upstream provider is clinging to old IP addresses. Often, finding that one hidden cache is the only thing standing between you and a live site.
How do I check if my records are actually being seen by the world?
Your local computer is often unreliable for testing these changes because it caches information to speed up performance; it might be showing you an old version of the site while the rest of the world sees the new one. To get a definitive answer, use an external tool to see what the global internet actually sees. If you have already updated your A records but your status is still stuck on “pending,” run a check through mxtool_it or host-checker.
If those tools show a mix of old and new IP addresses, you are dealing with propagation. This is simply the time it takes for every server across the globe to update their records to match your current Wix configuration. You will need to wait until all results align before the system clears your status. For a direct confirmation from your own terminal, you can verify the specific record using this command:
nslookup -type=a yourdomain.comLook specifically at the “Address” field in the output. If it displays only the IP addresses provided by Wix, your configuration is technically perfect. In that case, the “pending” status is just a temporary delay in the Let’s_Encrypt verification cycle and will clear on its own as the TTL (Time to Live) expires.
Reference Documentation
If you need to dig into the specifics of how Let’s_Encert handles certificate validation—especially regarding those tricky DNS-based challenges—you can find the full technical breakdown in the Mozilla Network Certificate Transparency documentation (https://mozilla.com) or on the official Let’s_Encert Project page (https://letsencrypt.org/).