Domain control validation backoff schedule

Domain control validation (DCV) has to happen before a Certificate Authority (CA) will issue a certificate for a domain.

DCV happens with Cloudflare’s CA partners according to the following schedule:

• Digicert - 30 days
• Google Trust Services - 14 days
• Let’s Encrypt - 7 days

Afterward, DCV tokens expire as dictated by the CA/B Baseline Requirements, which govern issuance of publicly trusted SSL certificates.

Here is the function that is used to determine the next check:

now() + min((floor(60 * pow(1.05, retry_attempt)) * INTERVAL '1 second'), INTERVAL '4 hours')

As the table below shows, most of the checks take place on the first day. Most validations complete within the first 5 minutes, unless the customer has misconfigured the CNAME to your domain. We cap the check back off to a maximum of 4 hours to avoid the function growing exponentially, which would result in large gaps between checks towards the end of the month.