# Help: ICP Gateway returns Error 400 Unknown Domain **URL:** \ **Category:** Developers\ **Created:** [September 7, 2025, 1:57pm UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948 "2025-09-07T13:57:33Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![rbirkner](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbirkner](https://forum.dfinity.org/u/rbirkner)\ **Post date:** [October 7, 2025, 8:13am UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/22 "2025-10-07T08:13:55Z")
> though it had been working all along with that option enabled It doesn’t always interfere. That’s why many users manage to register a custom domain with the option enabled. At some point later on, Cloudflare does not clean up the `TXT` records properly and the issue appears. We have observed that now multiple times with different domains. It only affects the apex. > I tried reregistration. It’s stuck in `PendingAcmeApproval` as well. You need to give it a few days in between a failed registration and resubmitting. When this issue exists, custom domains service faces a rate-limit opposed by Let’s Encrypt due to the repeated failure to obtain a certificate. ---
**Author:** ![Nimakra](https://avatars.discourse-cdn.com/v4/letter/n/aeb1de/32.png) [@Nimakra](https://forum.dfinity.org/u/Nimakra)\ **Post date:** [October 7, 2025, 3:30pm UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/23 "2025-10-07T15:30:51Z")
🥲 few days. So, is there like a way to automatically redirect users from the custom domain to the raw canister URL when the custom domain is unavailable, such as the case when there’s that `Error 400 Unknown Domain` ? ---
**Author:** ![barolukluk](https://avatars.discourse-cdn.com/v4/letter/b/3d9bf3/32.png) [@barolukluk](https://forum.dfinity.org/u/barolukluk)\ **Post date:** [October 11, 2025, 12:21pm UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/24 "2025-10-11T12:21:02Z")
I’m experiencing the same issue with my apex domain `mimento.ai`. - The domain was working fine before — then suddenly stopped issuing a valid certificate. - `www.mimento.ai` continues to work without any problems. - For the apex domain, the status now loops between `PendingAcmeApproval` and `Failed: order is unable to reach 'Ready' status`. - All CAA, TXT, and `_acme-challenge` CNAME records are correct and DNS resolves properly. - I also deleted the previous registration request and created a new one, but the problem persists. As a temporary workaround, I enabled Cloudflare **proxy for the apex CNAME record** and set up a redirect from `mimento.ai` → `www.mimento.ai`. This avoids the certificate error, but it’s not a real fix. Is there a known issue on the DFINITY side regarding ACME for apex domains, or any way to manually reset the challenge? ---
**Author:** ![bobekas](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/bobekas/32/20160_2.png) [@bobekas](https://forum.dfinity.org/u/bobekas)\ **Post date:** [October 13, 2025, 1:12pm UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/25 "2025-10-13T13:12:05Z")
Same here… [https://icptokens.net](https://icptokens.net) ---
**Author:** ![rbirkner](https://avatars.discourse-cdn.com/v4/letter/r/838e76/32.png) [@rbirkner](https://forum.dfinity.org/u/rbirkner)\ **Post date:** [October 13, 2025, 2:58pm UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/26 "2025-10-13T14:58:16Z")
Hey @barolukluk and @bobekas Which DNS provider are you using? If it is Cloudflare, are you sure you have disabled Universal SSL? You can do that as follows: Go to your domain in the cloudflare panel, then go to “SSL/TLS” → “Edge Certificates”, scroll all the way down and “Disable Universal SSL”. ---
**Author:** ![bobekas](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/bobekas/32/20160_2.png) [@bobekas](https://forum.dfinity.org/u/bobekas)\ **Post date:** [October 14, 2025, 10:21am UTC](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948/27 "2025-10-14T10:21:20Z")
Hey, Yes, we’re using Cloudflare and we’ve already disabled **Universal SSL** , but the certificate request is still stuck in **PendingAcmeApproval**. As a temporary workaround, we added a **www** subdomain — and that one went through successfully. The boundary node generated the certificate for the www domain without any issues, so for now we’re redirecting **non-www → www** as a short-term solution. However, the **non-www** certificate request remains stuck in **PendingAcmeApproval** , and it seems like something is blocking or looping during the regeneration process. [Previous page](https://forum.dfinity.org/t/help-icp-gateway-returns-error-400-unknown-domain/56948.md?page=1)