Reverse proxy: custom domain stuck on "Issuing certificate…" forever (NetBird Cloud)

Community Support Others
1

Describe the problem

Custom domain shows Active/verified in Reverse Proxy Custom Domains, but any service on it stays stuck at “Issuing certificate…” forever on NetBird Cloud (free plan, eu1 cluster). The built-in free domain on the same cluster issues its certificate instantly. This is not self-hosted.

To Reproduce

Steps to reproduce the behavior:

  1. Add custom domain mohandl3g.ly under Reverse Proxy, Custom Domains.
  2. Add wildcard CNAME *.mohandl3g.ly to eu1.netbird.services in Cloudflare, DNS-only (grey cloud).
  3. Click Verify Domain, and wait for status to become Active.
  4. Create a reverse proxy service for example jellyfin.mohandl3g.ly.
  5. Service stays at “Issuing certificate…” for hours; opening the URL shows the “certificate not issued” error.

Expected behavior

The proxy should automatically issue a Let’s Encrypt certificate via ACME (tls-alpn-01 on port 443) and the service should become Active.

Are you using NetBird Cloud?

Yes.

NetBird version

Client 0.76.3 (running in Docker on a Windows host).

Is any other VPN software installed?

No.

Debug output

To help us resolve the problem, please attach the following anonymized status output

netbird status -dA output:

Peers detail:
proxy-d9svd03l0ubs73egc660-146-234.netbird.cloud:
NetBird IP: 100.102.146.234
Status: Connected
Connection type: Relayed
Relay server address: rels://streamline-de-fra1-9.relay.netbird.io:443

proxy-d9svd03l0ubs73egc650-184-167.netbird.cloud:
NetBird IP: 100.102.184.167
Status: Connected
Connection type: Relayed
Relay server address: rels://streamline-es-mad1-0.relay.netbird.io:443

FQDN: mohandl3g-docker.netbird.cloud
NetBird IP: 100.102.138.213/16
Management: Connected to https://api.netbird.io:443
Signal: Connected to https://signal.netbird.io:443
Peers count: 2/2 Connected

Create and upload a debug bundle, and share the returned file key:

f79e391890ab27fb37c88b3b4be7011e22aa2e5ca6f38ffa9c4481884941f726/ceb6e079-aa91-4c4c-aea5-595552cb8604

Screenshots

image
image1675×199 15.6 KB

image
image2275×143 7.24 KB

image
image2281×229 17.6 KB

image
image732×529 8.83 KB

Additional context

Add any other context about the problem here.

Have you tried these troubleshooting steps?

  • Reviewed client troubleshooting (if applicable)
  • Checked for newer NetBird versions
  • Searched for similar issues on GitHub (including closed ones)
  • Restarted the NetBird client
  • Disabled other VPN software
  • Checked firewall settings
2

Hi all,

Posting this because hitting the same thing.

Setup: Using the built-in Reverse Proxy feature with custom domains (CNAME to eu1.netbird.services). All affected domains resolve to two cluster IPs:

$ dig <domain> +short
eu1.netbird.services.
54.37.79.68
57.129.98.79

Case 1 — URL1: TLS routing broken on one node only

Works fine on 54.37.79.68 (valid cert, correct HTTP response). On 57.129.98.79, every request fails immediately after ClientHello:

* (304) (OUT), TLS handshake, Client hello (1):
* LibreSSL/3.3.6: error:1404B438:SSL routines:ST_CONNECT:tlsv1 alert internal error

Deleted and recreated the service from scratch, retested against 57.129.98.79 multiple times over several hours — same error every time. Not a propagation delay.

Case 2 — URL2: works fine on the same node

To rule out a node-wide outage, I tested a second, pre-existing service directly against 57.129.98.79 — it works correctly (valid cert, correct response). So the node itself is up; only the URL1 service specifically seems out of sync there.

Case 3 — URL3: new service stuck issuing certificate

Created a brand-new, minimal service (plain HTTPS, single resource, no Geoblocking/CrowdSec) to test further. DNS resolved instantly to the same two IPs, but the service has been stuck in “Issuing certificate…” since yesterday with no progress.

Summary

Three independent cases all pointing at 57.129.98.79 in the eu1 cluster: one service with broken TLS routing there, one working fine, and a brand-new one stuck at cert issuance. Looks like an intermittent sync/health issue on that specific node rather than anything on my end (I’ve already opened a support ticket with these details).