---
title: I am having problems with my Load Balancer's certificate
description: Troubleshoot errors that you may experience when creating an SSL/TLS certificate, adding it to your Load Balancer frontend, or successfully handling HTTPS connections.
tags: load-balancer certificate ssl tls dns
dates:
  validation: 2025-09-22
  posted: 2025-03-10
---

## I'm experiencing DNS errors when adding an SSL/TLS certificate

You may be trying to [create or upload](/load-balancer/how-to/add-certificate/) a certificate for your Load Balancer, and receive the following error message:

```
invalid argument(s): dns_name does not respect constraint, <domain> does not resolve to your Load Balancer IP
```

### Cause

The domain name specified does not resolve to the Load Balancer's public IP address.

### Solution

Try the following steps:

- Ensure that a DNS record exists, pointing this domain to the Load Balancer's public IP address.
- Ensure that you have correctly typed the domain name, with no typos or errors.
- If you created the DNS record very recently, DNS propagation might not yet be complete. Wait for 30-60 minutes and try again, to see if the issue resolves itself.
- If you are trying to upload a custom certificate:
    - Check the certificate's validity dates and ensure it's not expired or not yet valid.
    - If the certificate has wildcards, ensure it covers the correct domain and subdomains. For example, if your certificate covers `*.example.com`, you can use it to secure `subdomain.example.com` but not `sub.subdomain.example.com`. Check the [IETF documentation](https://www.ietf.org/rfc/rfc2818.txt).
- If the error persists, check the DNS entry using a tool like `dig`, to ensure it is resolving correctly.


## I am experiencing HTTP errors when generating a Let's Encrypt SSL/TLS certificate

You may be trying to [generate a Let's Encrypt certificate](/load-balancer/how-to/add-certificate/#how-to-generate-and-add-a-lets-encrypt-certificate) for your Load Balancer, and receive the following error message:

```
HTTP error 400: The port 80 frontend must be associated to an HTTP backend
```

### Cause

Let's Encrypt certificates cannot be created for Load Balancers which have a frontend listening on port 80, but are attached to a **TCP** backend. This is because the Let's Encrypt challenge would fail. 

### Solution:

Ensure that your Load Balancer has either:
- An HTTP-protocol-backend attached to a frontend listening on port 80, or
- A TCP-protocol-backend attached to a frontend listening on a port other than 80

Alternatively, create and import your own [custom certificate](/load-balancer/how-to/add-certificate/#how-to-import-a-certificate) for your Load Balancer, rather than generating a Let's Encrypt certificate via Scaleway.

## I added a certificate to my Kubernetes Load Balancer via the Scaleway console, but it is not working correctly

You may have used the Scaleway console attach a certificate to your Kubernetes Kapsule Load Balancer, and then find that the SSL certificate does not work as expected afterwards, with connections lost and HTTPS traffic dropped.

### Cause

Kubernetes Kapsule is a managed service, as are the Load Balancers created as part of the cluster.
Modifying a Kubernetes Load Balancer via the Scaleway console results in non-permanent modifications which are not known to the Kubernetes Kapsule service, and therefore end up being overwritten.

### Solution

Always modify Kubernetes Load Balancers via the cluster's Cloud Controller Manager (CCM), using [Load Balancer annotations](/kubernetes/reference-content/using-load-balancer-annotations/). 

The specific annotation to use can be found in the [Scaleway CCM documentation](https://github.com/scaleway/scaleway-cloud-controller-manager/blob/master/docs/loadbalancer-annotations.md#servicebetakubernetesioscw-loadbalancer-certificate-ids).


## I have a different problem related to my Load Balancer SSL/TLS certificate

Check the following documentation:

- [How to add an SSL/TLS certificate](/load-balancer/how-to/add-certificate/)
- [Setting up SSL bridging, offloading or passthrough](/load-balancer/reference-content/ssl-bridging-offloading-passthrough/)
- [Load Balancer API Documentation: Certificates](https://www.scaleway.com/en/developers/api/load-balancer/zoned-api/#path-certificate-get-an-ssltls-certificate)
- [Load Balancer Terraform Documentation: Certificates](https://registry.terraform.io/providers/scaleway/scaleway/latest/docs/resources/lb_certificate)