I've been working for a while on a web application that has lived on two load-balanced DigitalOcean droplets (using a DigitalOcean loadbalancer, not my own load-balancing droplet) with SSL termination.

Up until now, the traffic has pointed to beta.mydomain.com, with an A record pointed to the load-balancer's IP. The load-balancer is set-up to do SSL-termination with an autogenerated SSL cert from Let's Encrypt.

The thing is that I'm moving out from beta so I wanted to change the site's URL to another subdomain (chile.mydomain.com). Thus, I:

1.- changed the basepath on my application to use the new domain (unrelated to this issue, but I mention it for the sake of completeness)

2.- created a new A record for the subdomain, pointed to the same LB

3.- reconfigured nginx (in both nginx.conf and sites-available) to listen for the new subdomain, checked everything with nginx -t and restarted. This is working correctly, as the site actually responds when I browse to the new domain

If I browse to the new domain, I get an SSL error (invalid cert). I figured it was because I had previously set-up the original certificate for the base domain and the beta subdomain as it can be seen in the cert's SAN section:

DNS Name=beta.mydomain.com
DNS Name=mydomain.com

So, no biggie: re-create the HTTP2 rule on the LB and use the new subdomain so I get a new certificate for the new subdomain. And here's the issue: When I try to do this, I get an error stating:

No NS records found for mydomain.com domain.

This didn't happen in the previous beta subdomain. I tried adding NS records for the subdomain too (pointed to ns1, 2 and 3.digitalocean.com) with a small TTL and now the error reads:

one or more digitalocean name server not found for domain

So basically the DO control panel is refusing to generate a new certificate for the domain (which I purchased from namecheap as a registrar, pointed it to digitalocean months ago and haven't touched it) even though the domain is fully hosted at digitalocean

I'm totally lost now, being trying to figure this out for quite a while now. This puzzles me because the beta subdomain never had it's own NS records (the only NS records are for the base domain)

What am I missing here? I'm sure it's something really stupid, but I'm starting to grow desperate


Out of frustration I tried to spin a up a second, new, load balancer and experienced the exact same result. I even tried to set up SSL termination in the new LB for the beta subdomain which already works in the first LB (not the new subdomain) and got exactly the same message. I forgot to add that I already opened a ticket with DigitalOcean support but I've yet to receive a response.


After a lot of brain-smashing and several attempts over the weekend, I finally got a response from Digital Ocean. It turned out not to be an error on my side but a bug on DO's backend that affected all Let's Encrypt certificate generation for load balancers (using certbot on specific droplets was OK). A fix was pushed on sunday morning (Eastern time) and the issue is now resolved.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.