Domain control validation backoff schedule

Domain control validation (DCV) has to happen before a Certificate Authority (CA) will issue a certificate for a domain. If DCV fails, Cloudflare automatically retries it on a schedule.

DCV happens with Cloudflare’s CA partners according to the following schedule:

• DigiCert - 30 days
• Google Trust Services - 14 days
• Let’s Encrypt - 7 days

Afterward, DCV tokens expire as dictated by the CA/B Baseline Requirements, which govern issuance of publicly trusted SSL certificates.

Here is the function that is used to determine the next check:

now() + min((floor(60 * pow(1.05, retry_attempt)) * INTERVAL '1 second'), INTERVAL '4 hours')

As the table below shows, most of the checks take place on the first day. Most validations complete within the first five minutes, unless the customer has misconfigured the CNAME to your domain. We cap the check backoff to a maximum of four hours to avoid the function growing exponentially, which would result in large gaps between checks towards the end of the month.