DocumentationExperience Cloud KCS

Troubleshooting SSL certificate ‘Failed’ status for custom domains in AEM Cloud Manager

Last update: October 14, 2026

Adobe Experience Manager (AEM) Cloud Manager may display a custom domain SSL certificate with aFailed status, preventing the certificate from being created or renewed even when DNS and CAA records appear correctly configured. The issue is indicated by a technical error message stating that Adobe must resolve the problem. To resolve the issue, validate the Adobe verification CNAME and CAA records, allow DNS propagation, reverify the certificate in Cloud Manager, and provide diagnostic information to Adobe Support if the failure persists.

Description description

Environment

Adobe Experience Manager (AEM) Cloud Manager

Issue/Symptoms

  • An SSL certificate created or renewed for a custom domain displays a Failed status in Cloud Manager.
  • The certificate can’t be created or renewed.
  • DNS and CAA records appear to be configured correctly.
  • The issue is visible in the SSL Certificates section of Cloud Manager.
  • A technical error message indicates that Adobe must resolve the issue.
  • The issue can occur with any custom domain integrated with Cloud Manager.

Resolution resolution

Follow the steps below to resolve the issue:

  1. In Cloud Manager, navigate to Domain Settings and copy the latest Adobe verification CNAME for the custom domain.

  2. Verify the DNS records from a local machine or terminal by running the following commands (replace the placeholders with the actual domain):

    • dig CNAME _acme-challenge.<domain> +short
    • dig CAA <domain> +short
    • dig CAA +short

  3. Confirm that the CNAME record matches the value displayed in Cloud Manager and points to the Adobe verification hostname.

  4. Ensure that any restrictive CAA policy allows letsencrypt.org as a valid certificate authority.

  5. After making DNS changes, allow time for DNS propagation and then use Verify in Cloud Manager to check whether the certificate status updates.

  6. If the DNS records are correct and the certificate status remains Failed, collect the output of the DNS commands, the timestamp of the checks, screenshots of the Cloud Manager interface and DNS records, and the result of: curl -Iv https://<domain>

  7. Provide the collected information to Adobe Support for further investigation.

  8. Verify that the issue is resolved by confirming that the SSL certificate status changes from Failed to Domain Verified & Deployed in Cloud Manager.

recommendation-more-help
experience-cloud-kcs-help-kbarticles