Google Cloud Run - Domain Mapping stuck at Certificate Provisioning

Question

Is anyone getting this issue with Google Cloud Run Domain Mapping? When I add a custom domain to my domain mappings, I get this:

Waiting for certificate provisioning. You must configure your DNS records for certificate issuance to begin.

I know it says it's only added 1 day ago and I should give it time, but I actually let it go for 5 days, deleted it, and this is my second try.

You can see in the below screenshot that it is added via Cloudflare. I even tried toggling the Proxy service on and off with no luck.

Answer 1

Turning proxying off in CloudFlare resolved the issue in my case (keeping it as DNS only).

Most likely the Google balancer needs to get the request first-hand in order to make the certificate safe.

Answer 2

I just tried Toggling the proxy off again it seemed to work. They must have fixed something internally.

Answer 3

I faced the same issue with exact error:

Waiting for certificate provisioning. You must configure your DNS records for certificate issuance to begin.

After digging a bit more the error actually made sense. Before generating the cert Google is trying to check if our DNS records are properly configured and well propagated through all regions which is not the case for me due to some glitch at the nameserver level. I raised a ticket with my nameserver vendor with the DNS propagation report from the below tools/websites which clearly showed that the DNS records are not available in some regions. Once they fixed the propagation issue, all my reports started to show positive results after which I recreated my domain mapping and it worked within few minutes.

Tools used to check DNS propagation status:

• https://dnspropagation.net/
• https://www.whatsmydns.net/
• https://dnschecker.org/

Answer 4

At the moment, seems like Domain Mapping is just a buggy service.

Seems like the solution at the moment is to be patient and to try several times until it works. I'd suggest to give it some time between attempts.

The reasons why I feel it's a buggy service:

1. gcloud beta run domain-mappings create stucks at Creating......⠼.
2. gcloud beta run domain-mappings describe shows messages such as:

• "Domain mapping '[...domain_name...]' already exists for this application. You can modify this domain mapping with DomainMappings.PATCH".
• "Waiting for certificate provisioning. You must configure your DNS records for certificate issuance to begin." - Even though the DNS records are fine.

3. User Interface isn't any better. It also can stuck while creating... And in the console, it says that it may fail silently, suggesting to use gcloud CLI as a workaround

Update 2022

It's been a while since I last used this feature but it is still taking ~2 hours for the domain to become available.