Subject: SSL activation for www.missjtech.site stuck in processing for about a week

Develop, Build & Integrate CMS Development
,
1

Subject: SSL activation for www.missjtech.site stuck in processing for about a week

Hi, I need help with a stuck SSL activation issue in HubSpot.

My domain www.missjtech.site is connected in Domains & URLs, and missjtech.site redirects to www.missjtech.site. My DNS in Hostinger appears to be configured correctly, including the www CNAME pointing to HubSpot. However, HubSpot has shown “SSL activation for www.missjtech.site is processing” for about a week.

Because SSL has not completed, the root/public loading behavior is still not working as expected.

I already checked:

domain connection in HubSpot
redirect from root to www
Hostinger DNS records
no visible CAA record in the DNS list I reviewed
Has anyone seen HubSpot SSL provisioning get stuck like this on a connected domain, and what is the exact fix?

Thank you.

3

Hi there @Miss_J-Tech_Support,

Thank you for posting to the Community! Tagging in some of our Top Contributors to see if they have experienced this before – Hi @Humashankar and @SanjayKumar have either of you seen this behavior? If so, how did you resolve?

Thank you in advance!

Cassie, Community Manager

4

Hi, @Miss_J-Tech_Support this is one of the more common “stuck in processing” causes, so let’s work through it systematically.

HubSpot now provisions SSL certificates through Google Trust Services (not Let’s Encrypt) — so if there’s any CAA record anywhere in the domain’s chain, pki.goog needs to be explicitly authorized in it, or issuance will silently stall. A couple of things worth double-checking given what you’ve already ruled out:

  1. Check the CAA record at the root domain, not just the www subdomain. CAA records are inherited up the DNS chain — if you only checked records directly under www.missjtech.site, you may have missed a restrictive CAA record sitting on the apex/root domain (missjtech.site) that’s blocking issuance for the whole domain tree, including www. Run dig missjtech.site CAA (not just the www version) to confirm there’s truly nothing there.
  2. If there IS a CAA record you haven’t spotted, add:
   0 issue "pki.goog"

at the root domain level. If you’re still carrying an old CAA record from a previous Let’s Encrypt setup, HubSpot’s own guidance is to remove that and replace it with one authorizing Google Trust Services.

  1. If there’s genuinely no CAA record anywhere (which normally means any CA is allowed, so shouldn’t be the blocker) — then this is likely stuck server-side on HubSpot’s end rather than a DNS misconfiguration, since a week is well beyond the normal few-hours provisioning window.

Given you’ve already correctly checked domain connection, redirect, and DNS — if step 1/2 above doesn’t turn up a hidden CAA record, this has crossed from “self-serve DNS issue” into “needs HubSpot Support to manually re-trigger or inspect the certificate request.” At that point, contact HubSpot Support directly (not just the community) and reference how long it’s been stuck — in similar past cases, support has had to manually intervene on their end to get the certificate issued.