diff --git a/pages/edge-services/reference-content/cname-record.mdx b/pages/edge-services/reference-content/cname-record.mdx index 781d4c14d3..8d273b86a5 100644 --- a/pages/edge-services/reference-content/cname-record.mdx +++ b/pages/edge-services/reference-content/cname-record.mdx @@ -69,25 +69,4 @@ You may also see a `TTL` field, which stands for **T**ime **T**o **L**ive. This ## Troubleshooting DNS and subdomain errors -When setting up your customized subdomain with Edge Services, you have the option to carry out a verification check on the CNAME record (if your domain is managed with an external provider). Edge Services will query the subdomain and check that it resolves correctly to the Edge Services endpoint. If there is a problem, you will see an error message: - - - -An error message may also display at a later point from your Edge Services dashboard if a problem is detected at any point with your CNAME record or subdomain: - - - -See the table below for help with troubleshooting these errors: - -| Error message | Solution | -|-------------------------------------------|---------------------------------------------------------------------| -| No CNAME record found | Make sure you have created a valid DNS record of type **CNAME** (not **A**, **AAAA** or another type), where your subdomain points to the Edge Services endpoint. | -| Incorrect CNAME | Make sure your CNAME record points to the Edge Services endpoint in the format `pipeline-id.svc.edge.scw.cloud.`, and that you have replaced `pipeline-id` with the ID of your bucket or Load Balancer's Edge Services pipeline. | -| Domain does not exist | You must own the domain name you are attempting to configure. If you do not already own the domain name, you cannot create a subdomain or CNAME record for it. Register the domain name, for example using our [Domains and DNS](/domains-and-dns/how-to/register-internal-domain/) product, then create a CNAME record for the subdomain. Otherwise, ensure you did not make a typo when entering the domain name into the Scaleway console. | -| scw.cloud is forbidden | You cannot use subdomains of the `scw.cloud` domain, as the domain is owned and managed by Scaleway and you cannot create DNS records for it. Use your own domain and subdomain. | -| Invalid Top Level Domain | Make sure the Top-Level Domain (e.g. `.com`, `.fr`) you entered is correct. | -| Root domain not allowed | You cannot use a root domain alone to customize Edge Services (e.g. `example.com`. Make sure you use a subdomain (e.g. `blog.example.com`)) | | -| Subdomain must be a correctly-formatted, fully-qualified subdomain name | Make sure the subdomain name you entered is [correctly formatted](https://en.wikipedia.org/wiki/Domain_name#Domain_name_syntax), e.g. `foo.example.fr`. | -| Record already exists for this FQDN in your DNS zone | Choose a different subdomain, or delete the existing DNS record. | - -Note that if your domain is managed by Scaleway Domains and DNS and you therefore have an auto-created CNAME record, you should **not** attempt to delete it or modify it in any way. Scaleway will take care of deleting the CNAME record if and when you deactivate Edge Services. +See our [dedicated documentation](/edge-services/troubleshooting/cname-errors/) for help resolving any error message you may get related to your CNAME record. \ No newline at end of file diff --git a/pages/edge-services/reference-content/ssl-tls-certificate.mdx b/pages/edge-services/reference-content/ssl-tls-certificate.mdx index cca02513c7..fd3474bbbb 100644 --- a/pages/edge-services/reference-content/ssl-tls-certificate.mdx +++ b/pages/edge-services/reference-content/ssl-tls-certificate.mdx @@ -58,15 +58,7 @@ Note that you will not have access to the generated certificate itself in Secret ### Troubleshooting Let's Encrypt certificate errors -#### Errors - -If there is a problem generating your managed Let's Encrypt certificate, an error will be displayed. See the table below for help resolving these errors. - -| Error | Solution | -| ------------------------------------------------------------------------|---------------------------------------------------------------------| -| Too many certificates already issued for this domain | Wait, before retrying. This error occurs when you hit the limit of generating 50 Let's Encrypt certificates in a rolling 7 day period for the same domain. | -| Internal managed certificate error | There has been an unspecified error in generating a managed Let's Encrypt certificate for your subdomain. Try [resetting your domain to the default endpoint](/edge-services/how-to/configure-custom-domain/#how-to-reset-your-customized-domain), and then recustomizing it again, to trigger generation of a new Let's Encrypt certificate. If that fails, [open a support ticket](https://console.scaleway.com/support/tickets/create). | -| Certificate cannot be renewed - Your CNAME record is no longer accurate | Your CNAME record has either been deleted or modified. Without a correct CNAME record, we cannot renew your managed Let's Encrypt certificate. [Rectify your CNAME record](/edge-services/reference-content/cname-record/#how-to-create-a-cname-record), and when Edge Services detects the correct record exists, your certificate will be automatically renewed. | +See our [dedicated documentation](/edge-services/troubleshooting/certificate-errors/) for help resolving errors experienced when generating or renewing an Edge Services Let's Encrypt certificate. ## Using your own certificate @@ -196,36 +188,4 @@ If you change your customized subdomain to something new, you will need to gener ### Troubleshooting certificate errors -#### Errors - -If Edge Services detects a problem with your certificate, an error will be displayed. See the table below for help resolving these errors. - -| Error | Solution | -|-------------------------------------------------------------------------|---------------------------------------------------------------------| -| Certificate format | Make sure your certificate is in [PEM format](#pem-format-certificate-chain). | -| Certificate private key format | Make sure your private key is in [PEM format](#pem-format-certificate-chain).| -| Missing server certificate | Make sure the server certificate (which validates your own subdomain) is included in the [PEM-formatted chain](#pem-format-certificate-chain).| -| Missing private key | Make sure your private key is included in the [PEM-formatted chain](#pem-format-certificate-chain).| -| Missing root certificate | Make sure a valid root certificate is included in the [PEM-formatted chain](#pem-format-certificate-chain). | -| Wrong order | Make sure the server certificate (which validates your own subdomain) is listed before the intermediate and root certificates in the [PEM-formatted chain](#pem-format-certificate-chain) | -| Too many private keys | Make sure the [PEM-formatted chain](#pem-format-certificate-chain) includes only one corresponding private key | -| Self-signed certificates not allowed | Create and upload a certificate issued by a recognized [certificate authority](#tips-for-creating-a-certificate). If you receive this error but believe your certificate is legitimately signed by an official CA, [open a support ticket](https://console.scaleway.com/support/tickets) to tell us. | -| Invalid intermediate or root certificate authority | Make sure each **Issuer** field matches the **Subject** of the next certificate in the [PEM-formatted chain](#pem-format-certificate-chain).| -| Incorrect root certificate | Make sure your server certificate chains up to the provided root(s) certificate(s) in the [PEM-formatted chain](#pem-format-certificate-chain). | -| Private key and certificate mismatch | Make sure the private key in the [PEM-formatted chain](#pem-format-certificate-chain) matches the server certificate. | -| Subdomain and server certificate mismatch | Make sure the subdomain you configured for Edge Services matches that of the server certificate. | -| Certificate expired | [Create a new certificate](#keeping-your-certificate-up-to-date) and import it. | - -If any of these errors are detected while you are initially configuring your subdomain, you will be blocked from continuing until the error is fixed. - -However, these errors may also be detected and displayed on your Edge Services dashboard even after you have initially successfully configured your subdomain and certificate. This could be the case, for example, if your certificate has since expired, you have modified your subdomain without modifying the certificate, or you have modified the certificate in Secret Manager. In this case, your initial certificate will remain in use by Edge Services until the error is fixed, but clients may see an error in their browser as they try to access your customized domain. - -To fix the problem, you must generate a valid certificate, and then do one of the following: - -- [Use Edge Services to import a new certificate directly](/edge-services/how-to/configure-custom-domain/#how-to-edit-your-customized-domain-or-its-certificate) -- [Create a new secret](/secret-manager/how-to/create-secret/) to hold the certificate in Secret Manager, and [edit your customized endpoint with Edge services](/edge-services/how-to/configure-custom-domain/#how-to-edit-your-customized-domain-or-its-certificate) to tell it to use this secret -- [Create a new version](/secret-manager/how-to/create-version/) of the existing secret holding your expired certificate, where the new version contains a valid certificate. If Edge Services is already using this secret, it will automatically detect and use the new version - it always uses the most recent enabled version of a secret. - -#### Secret not visible for selection in Edge Services - -You may find that a certificate you have stored in Secret Manager is not available for selection from Edge Services. This is probably because the secret does not have the "certificate" type, which is necessary for it to be visible to Edge Services. The "type" of a secret can be defined when creating a secret via the [API](https://www.scaleway.com/en/developers/api/secret-manager/#path-secrets-create-a-secret), but not via the console. For that reason, if you prefer to use the console to create your certificates, we suggest manually importing the certificate via Edge Services rather than via Secret Manager. This way, it will automatically inherit the "certificate" type. \ No newline at end of file +See our [dedicated documentation](/edge-services/troubleshooting/certificate-errors/) for help resolving errors associated with your custom certificate for Edge Services. \ No newline at end of file diff --git a/pages/edge-services/troubleshooting/assets/scaleway-edge-services-cname-error.webp b/pages/edge-services/troubleshooting/assets/scaleway-edge-services-cname-error.webp new file mode 100644 index 0000000000..a0f926abaa Binary files /dev/null and b/pages/edge-services/troubleshooting/assets/scaleway-edge-services-cname-error.webp differ diff --git a/pages/edge-services/troubleshooting/assets/scaleway-edge-services-dashboard-error.webp b/pages/edge-services/troubleshooting/assets/scaleway-edge-services-dashboard-error.webp new file mode 100644 index 0000000000..59296526db Binary files /dev/null and b/pages/edge-services/troubleshooting/assets/scaleway-edge-services-dashboard-error.webp differ diff --git a/pages/edge-services/troubleshooting/certificate-errors.mdx b/pages/edge-services/troubleshooting/certificate-errors.mdx new file mode 100644 index 0000000000..e6c70748db --- /dev/null +++ b/pages/edge-services/troubleshooting/certificate-errors.mdx @@ -0,0 +1,97 @@ +--- +meta: + title: I am experiencing problems with my Edge Services certificate + description: Troubleshoot issues that may arise when adding an SSL/TLS certificate so that Scaleway Edge Services can serve content over HTTPS for your custom domain. +content: + h1: I am experiencing problems with my Edge Services certificate + paragraph: Troubleshoot issues that may arise when adding an SSL/TLS certificate so that Scaleway Edge Services can serve content over HTTPS for your custom domain. +tags: edge-services custom domain certificate ssl lets-encrypt +dates: + validation: 2025-03-14 + posted: 2025-03-14 +categories: + - network +--- + +You may experience errors when generating or uploading a certificate to your Edge Services pipeline. + +This page helps you resolve common problems. + +## I am getting an error message when generating a Let's Encrypt certificate. + +You may get an error message when [customizing your Edge Services domain](/edge-services/how-to/configure-custom-domain/) and generating a certificate for the first time, or later on your Edge Services dashboard when your certificate is due for renewal. + +### Cause + +Either: + +- Too many certificates have already been issued for this domain in too short a time, or +- Your CNAME record is not accurate and the certificate domain cannot be resolved, or +- There is an internal error + +### Solutions + +See the table below for help resolving these errors. + +| Error | Solution | +| ------------------------------------------------------------------------|---------------------------------------------------------------------| +| Too many certificates already issued for this domain | Wait, before retrying. This error occurs when you hit the limit of generating 50 Let's Encrypt certificates in a rolling 7 day period for the same domain. | +| Internal managed certificate error | There has been an unspecified error in generating a managed Let's Encrypt certificate for your subdomain. Try [resetting your domain to the default endpoint](/edge-services/how-to/configure-custom-domain/#how-to-reset-your-customized-domain), and then recustomizing it again, to trigger generation of a new Let's Encrypt certificate. If that fails, [open a support ticket](https://console.scaleway.com/support/tickets/create). | +| Certificate cannot be renewed - Your CNAME record is no longer accurate | Your CNAME record has either been deleted or modified. Without a correct CNAME record, we cannot renew your managed Let's Encrypt certificate. [Rectify your CNAME record](/edge-services/reference-content/cname-record/#how-to-create-a-cname-record), and when Edge Services detects the correct record exists, your certificate will be automatically renewed. | + +## I am getting an Edge Services error message for my own custom certificate + +You may get an error message if Edge Services detects a problem with your own [custom certificate](/edge-services/reference-content/ssl-tls-certificate/#using-your-own-certificate) for your pipeline. + +### Cause + +Either: + +- There is a problem with the format of your certificate, or +- There is a problem with the content of your certificate, or +- The issuing Certificate Authority is not recognized, or +- Your certificate has expired + +### Solutions + +See the table below for help resolving these errors. + +| Error | Solution | +|-------------------------------------------------------------------------|---------------------------------------------------------------------| +| Certificate format | Make sure your certificate is in [PEM format](#pem-format-certificate-chain). | +| Certificate private key format | Make sure your private key is in [PEM format](#pem-format-certificate-chain).| +| Missing server certificate | Make sure the server certificate (which validates your own subdomain) is included in the [PEM-formatted chain](#pem-format-certificate-chain).| +| Missing private key | Make sure your private key is included in the [PEM-formatted chain](#pem-format-certificate-chain).| +| Missing root certificate | Make sure a valid root certificate is included in the [PEM-formatted chain](#pem-format-certificate-chain). | +| Wrong order | Make sure the server certificate (which validates your own subdomain) is listed before the intermediate and root certificates in the [PEM-formatted chain](#pem-format-certificate-chain) | +| Too many private keys | Make sure the [PEM-formatted chain](#pem-format-certificate-chain) includes only one corresponding private key | +| Self-signed certificates not allowed | Create and upload a certificate issued by a recognized [certificate authority](#tips-for-creating-a-certificate). If you receive this error but believe your certificate is legitimately signed by an official CA, [open a support ticket](https://console.scaleway.com/support/tickets) to tell us. | +| Invalid intermediate or root certificate authority | Make sure each **Issuer** field matches the **Subject** of the next certificate in the [PEM-formatted chain](#pem-format-certificate-chain).| +| Incorrect root certificate | Make sure your server certificate chains up to the provided root(s) certificate(s) in the [PEM-formatted chain](#pem-format-certificate-chain). | +| Private key and certificate mismatch | Make sure the private key in the [PEM-formatted chain](#pem-format-certificate-chain) matches the server certificate. | +| Subdomain and server certificate mismatch | Make sure the subdomain you configured for Edge Services matches that of the server certificate. | +| Certificate expired | [Create a new certificate](#keeping-your-certificate-up-to-date) and import it. | + +If any of these errors are detected while you are initially configuring your subdomain, you will be blocked from continuing until the error is fixed. + +However, these errors may also be detected and displayed on your Edge Services dashboard even after you have initially successfully configured your subdomain and certificate. This could be the case, for example, if your certificate has since expired, you have modified your subdomain without modifying the certificate, or you have modified the certificate in Secret Manager. In this case, your initial certificate will remain in use by Edge Services until the error is fixed, but clients may see an error in their browser as they try to access your customized domain. + +To fix the problem, you must generate a valid certificate, and then do one of the following: + +- [Use Edge Services to import a new certificate directly](/edge-services/how-to/configure-custom-domain/#how-to-edit-your-customized-domain-or-its-certificate) +- [Create a new secret](/secret-manager/how-to/create-secret/) to hold the certificate in Secret Manager, and [edit your customized endpoint with Edge services](/edge-services/how-to/configure-custom-domain/#how-to-edit-your-customized-domain-or-its-certificate) to tell it to use this secret +- [Create a new version](/secret-manager/how-to/create-version/) of the existing secret holding your expired certificate, where the new version contains a valid certificate. If Edge Services is already using this secret, it will automatically detect and use the new version - it always uses the most recent enabled version of a secret. + +## The secret containing my custom certificate is not visible for selection in Edge Services + +You may find that a certificate you have stored in Secret Manager is not available for selection from Edge Services. + +### Cause + + This is probably because the secret does not have the "certificate" type, which is necessary for it to be visible to Edge Services. + +### Solution + +The "type" of a secret can be defined when creating a secret via the [API](https://www.scaleway.com/en/developers/api/secret-manager/#path-secrets-create-a-secret), but not via the console. + +For this reason, if you prefer to use the console to create your certificates, we suggest manually importing the certificate via Edge Services rather than via Secret Manager. This way, it will automatically inherit the "certificate" type. \ No newline at end of file diff --git a/pages/edge-services/troubleshooting/cname-errors.mdx b/pages/edge-services/troubleshooting/cname-errors.mdx new file mode 100644 index 0000000000..cbed612301 --- /dev/null +++ b/pages/edge-services/troubleshooting/cname-errors.mdx @@ -0,0 +1,37 @@ +--- +meta: + title: I am experiencing problems with my Edge Services CNAME record + description: Troubleshoot issues that may arise when adding an CNAME record so that Scaleway Edge Services can serve content over HTTPS for your custom domain. +content: + h1: I am experiencing problems with my Edge Services CNAME record + paragraph: Troubleshoot issues that may arise when adding an CNAME record so that Scaleway Edge Services can serve content over HTTPS for your custom domain.. +tags: edge-services custom domain cname record dns +dates: + validation: 2025-03-14 + posted: 2025-03-14 +categories: + - network +--- + +When setting up your customized subdomain with Edge Services, you have the option to carry out a verification check on the CNAME record (if your domain is managed with an external provider). Edge Services will query the subdomain and check that it resolves correctly to the Edge Services endpoint. If there is a problem, you will see an error message: + + + +An error message may also display at a later point from your Edge Services dashboard if a problem is detected at any point with your CNAME record or subdomain: + + + +The table below helps you resolve these errors: + +| Error message | Solution | +|-------------------------------------------|---------------------------------------------------------------------| +| No CNAME record found | Make sure you have created a valid DNS record of type **CNAME** (not **A**, **AAAA** or another type), where your subdomain points to the Edge Services endpoint. | +| Incorrect CNAME | Make sure your CNAME record points to the Edge Services endpoint in the format `pipeline-id.svc.edge.scw.cloud.`, and that you have replaced `pipeline-id` with the ID of your bucket or Load Balancer's Edge Services pipeline. | +| Domain does not exist | You must own the domain name you are attempting to configure. If you do not already own the domain name, you cannot create a subdomain or CNAME record for it. Register the domain name, for example using our [Domains and DNS](/domains-and-dns/how-to/register-internal-domain/) product, then create a CNAME record for the subdomain. Otherwise, ensure you did not make a typo when entering the domain name into the Scaleway console. | +| scw.cloud is forbidden | You cannot use subdomains of the `scw.cloud` domain, as the domain is owned and managed by Scaleway and you cannot create DNS records for it. Use your own domain and subdomain. | +| Invalid Top Level Domain | Make sure the Top-Level Domain (e.g. `.com`, `.fr`) you entered is correct. | +| Root domain not allowed | You cannot use a root domain alone to customize Edge Services (e.g. `example.com`. Make sure you use a subdomain (e.g. `blog.example.com`)) | | +| Subdomain must be a correctly-formatted, fully-qualified subdomain name | Make sure the subdomain name you entered is [correctly formatted](https://en.wikipedia.org/wiki/Domain_name#Domain_name_syntax), e.g. `foo.example.fr`. | +| Record already exists for this FQDN in your DNS zone | Choose a different subdomain, or delete the existing DNS record. | + +Note that if your domain is managed by Scaleway Domains and DNS and you therefore have an auto-created CNAME record, you should **not** attempt to delete it or modify it in any way. Scaleway will take care of deleting the CNAME record if and when you deactivate Edge Services. diff --git a/pages/edge-services/troubleshooting/index.mdx b/pages/edge-services/troubleshooting/index.mdx new file mode 100644 index 0000000000..eef10303e4 --- /dev/null +++ b/pages/edge-services/troubleshooting/index.mdx @@ -0,0 +1,67 @@ +--- +meta: + title: Edge Services - Troubleshooting + description: Find troubleshooting resources for resolving issues with Scaleway Edge Services. Get your pipelines running smoothly with our guides. +content: + h1: Edge Services - Troubleshooting + paragraph: Find troubleshooting resources for resolving issues with Scaleway Edge Services. Get your pipelines running smoothly with our guides. +dates: + posted: 2025-03-14 + validation: 2025-03-14 +categories: + - network +--- + + + +## Featured Pages + + + + + + + + + + + + +## Edge Services troubleshooting pages + +- [I am experiencing problems with my Edge Services certificate](/edge-services/troubleshooting/certificate-errors/) +- [I am experiencing problems with my Edge Services CNAME record](/edge-services/troubleshooting/cname-errors/)