Lovable custom domain stuck on Pending, or the SSL certificate never issued

What you're seeing

You connected a domain in Lovable's Project → Settings → Domains, and it never reaches Live. The status stays on Pending, Verifying or Setting up, or it changes to Stalled or Failed. Open the domain in a browser and you get a certificate warning instead of your app.

Lovable issues the certificate for your domain. You don't buy or upload one, and a certificate from your registrar isn't used. So a missing certificate means one of three things. Lovable can't see the DNS records it needs, something in your DNS blocks the certificate authority, or Lovable itself is having a problem. The status tells you which one to check.

If the domain works and the app itself is broken, start at Lovable app not working instead.

Step 1: find your status

Step 2: domain bought through Lovable, stuck on Pending

There's nothing to change in DNS here: Lovable creates the records and the certificate itself. Per Lovable's guide, setup usually finishes within 30 minutes but can take up to a day. After about 30 minutes the status shows Taking longer than usual with a Check status button. If it still hasn't finished after a few hours, Lovable says to contact their support.

Two things can stop a bought domain:

• Action required or Suspended: ICANN needs you to confirm the registrant email. Click the link in the verification email. A suspended domain can take up to 15 minutes to come back after you verify.
• Custom nameservers. If you pointed the domain's nameservers somewhere else (for example Cloudflare), Lovable stops managing its DNS. You then have to recreate every record at the new provider, and Step 3 applies.

Step 3: your own domain, stuck on Verifying

Lovable needs exactly two records per hostname, and nothing else on that name pointing anywhere else:

If you kept the www redirect, www is a separate domain with its own pair: an A record named www and a TXT named _lovable.www, with the value from its setup window.

Check what the internet sees:

dig +short A yourdomain.com             # expect 185.158.133.1 and nothing else
dig +short TXT _lovable.yourdomain.com  # expect your lovable_verify= value
dig +short AAAA yourdomain.com          # expect no output

What to fix:

• More than one A value, or an old IP: delete the old A, AAAA and CNAME records for that name from your previous host. Keep your MX records so email keeps working.
• Any AAAA record: Lovable says AAAA records interfere with setup and send traffic to the wrong place. Delete them.
• The record shows an orange cloud in Cloudflare: it's proxied. Lovable's docs say: "Do not enable proxying on the A record." Set it to DNS only (gray cloud) while it verifies, or use Step 5.
• TXT missing or wrong: compare the name and the full lovable_verify= value with the table Lovable shows under the domain while it's Verifying.

Then click Check status. If you see "Hold on, we just checked this", wait about five minutes. DNS changes are often live within minutes and usually within a few hours, but Lovable allows up to 72 hours. If the records never arrive in that time, the domain shows Removed and you have to Reconnect it.

Step 4: Setting up, Stalled or Failed: the certificate won't issue

Your records are verified, and the certificate is the problem now.

Check for CAA records. A CAA record lists the certificate authorities allowed to issue for your domain. If yours doesn't include one Lovable uses, issuance fails. A subdomain with no CAA records of its own inherits the parent's, so check both:

dig +short CAA yourdomain.com
dig +short CAA app.yourdomain.com   # if you're connecting a subdomain

No output means no CAA records, so CAA isn't your problem. If there is output, Lovable recommends allowing all three of the authorities it uses:

0 issue "pki.goog"
0 issue "letsencrypt.org"
0 issue "ssl.com"

If your provider has separate fields, use flag 0, tag issue, and the issuer domain without quotes. If you can't edit the parent domain, add these at the subdomain: its records take precedence. Or delete the CAA records if nobody in your organisation needs them.

Then click Retry. For Stalled, Lovable's docs say Retry is enough and you don't need to remove and re-add the domain. For Failed, click Retry too. If there's still no certificate after 72 hours, Lovable says to contact their support. For a domain that never goes live, Lovable's troubleshooting list also includes removing and re-adding it in Project → Settings → Domains.

Look at what Lovable's server presents. With the A record on DNS only, you can connect to Lovable's edge address directly and ask for your name:

openssl s_client -connect 185.158.133.1:443 -servername yourdomain.com </dev/null 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

A certificate for your domain with current dates means it has been issued. Anything else suggests it hasn't been yet, so do the CAA check and Retry. openssl shows what the server sends without validating it, so treat this as a quick look and go by the status in Lovable.

Step 5: you use Cloudflare

Lovable gives you two working setups. A mix of the two (orange cloud on Lovable's A record) is what gets stuck.

1. Gray cloud. Keep the A and TXT records from Step 3 on DNS only. Lovable's docs point here for Cloudflare errors 1001 and 1003: switch to gray cloud, wait a few minutes, try again.
2. Lovable's proxy mode. If you want Cloudflare in front, disconnect the domain and connect it again with Advanced → Uses Cloudflare or similar proxy on. Lovable then gives you one CNAME record pointing at your project's lovable.app address (shown in Project → Settings → Domains after you publish). That CNAME replaces the A record, and no TXT record is needed. With the root domain and www redirect, you get a CNAME for each. Once the CNAME is correct, Lovable issues the certificate and the domain goes Live. In this mode Lovable says it "does not configure, validate, or monitor your CDN or proxy setup", so the Cloudflare side is yours to keep working.

When it's Lovable, not you

Sometimes the certificate fails on Lovable's side. On 7 July 2026, Lovable reported that "SSL certificates are failing to provision for user-added custom domains" and resolved it the same day. For any domain still not active afterwards, the advice was that "removing and re-adding it will retry the process." If your records check out, look at Lovable's status page before you change DNS. For a normal Stalled or Failed status, start with Retry, and keep remove-and-re-add as the fallback.

Check it from outside

Run your domain through our free custom-domain certificate checker. It looks up the domain and its www twin, checks the A, AAAA and CNAME records, and reads the certificate each name presents: whether it exists, covers the name, who issued it and when it expires. It flags a certificate that's still pending, and www and the apex pointing in different directions.

If your record is proxied through Cloudflare, the checker can't read Lovable's certificate behind it. It will tell you the name is proxied and catch Cloudflare 525/526 errors. For the rest, go by the status in Lovable's Domains page.

Domain fixed but the app still isn't ready for real users? Start with a Production Readiness Audit.

Sources

All read on 24 October 2026. Lovable docs pages carry no dates.

1. Lovable, "Set up a custom domain"
2. Lovable, "Launch your site on a custom domain"
3. Pulsetic, Lovable status, incident #5199 "Custom Domain Configurations Failing" (7 July 2026)
4. OpenSSL, openssl-s_client manual