My custom domain’s SSL certificate won’t renew

If you pointed a custom domain at your SpliceRun instance (Growth and above) through Cloudflare, and SSL suddenly stops renewing, the cause is almost always the same: Cloudflare’s firewall is silently blocking the renewal check.

What’s actually happening

When your domain is proxied through Cloudflare (orange-cloud DNS, not grey-cloud DNS-only), Cloudflare sits in front of every request — including the automated certificate-renewal challenge our server needs to prove domain control. Cloudflare’s WAF can flag and block that request as suspicious traffic, with no obvious error pointing to the real cause.

The fix

• In Cloudflare, open Security → WAF and add a Skip exception for /.well-known/* on your domain. That path is where the renewal challenge lives and should never be blocked.
• Set SSL/TLS mode to Full (Strict), not Flexible. Flexible mode causes separate problems with n8n webhooks and WebSockets.
• If you do not need Cloudflare proxy features, switch the domain to DNS-only (grey cloud). You lose CDN/WAF for that hostname, but you avoid this entire class of issue.

After the WAF exception, the next scheduled renewal should succeed automatically. If it still fails after 24 hours, open a support ticket and we will take a look.

Why this catches people off guard

n8n webhook and WebSocket traffic is more sensitive to how a domain is proxied than most websites. It is not a bug in your setup or ours — it is a real interaction worth knowing before it becomes a “why did my site suddenly break” moment.

Written by the team that operates production n8n for customers. No invented case studies — just what we see when certificates stop renewing.