The opt-in URL must serve a certificate that verifies

The requirementstatement

The opt-in URL must present a valid, verifiable TLS certificate — not expired, self-signed, or issued for another hostname.

Severityseverity: BlockingBLOCKINGBreaking this rule gets the submission rejected. There is no partial credit.
When it bitesphase: Gates approvalapprovalGet this wrong and the brand or campaign is refused at registration.
What is checkedobject: opt-in URL TLS chain
Where it liveslayer: Consent flowCONSENT_FLOW
How Ekas settles itdetectability: AI · crawlCRAWL; Needs your live site or policy page fetched and read. Ekas crawls it the way a reviewer would.
What the fix involvesfailureClass: Fix the websiteTERMINAL_WEBSITE; The fix lives on your site. No amount of rewording the form clears it.
Who requires itauthorities: AWSBandwidth
When it appliesapplicabilityText: Applies to every 10DLC registration.

Why this rule existsrationale

A crawler that hits a certificate error stops there and reports the opt-in as unverifiable, so the rejection reads as "we could not see your consent surface" rather than as a certificate problem. Brands lose days to that translation, because the page loads perfectly in a browser that has been clicking through the warning for months.

How to fix itremediation

Renew or reissue the certificate for the exact hostname in the submitted URL, including the www or bare-domain form you actually registered. Test it from outside your network — an internal proxy or a pinned certificate hides the failure from everyone inside. Done when an external SSL checker reports a complete, valid chain.

A compliant exampleexample

opt_in_url: https://acmecoffee.com/checkout — certificate valid for acmecoffee.com, chain complete.

Common mistakespitfalls

A certificate valid for acmecoffee.com and not for www.acmecoffee.com fails whenever the submitted URL uses the other form, which is the most common version of this.
An expired intermediate still lets most browsers through and fails a strict crawler — the browser test is not the test that matters.

Provider rejection codescodes

The code you get back when this rule is what failed, and whether that provider lets you resubmit.

Provider	Code	Resubmit
Bandwidth/DCA	2103	Yes

Notesnotes

CRAWLER GAP, now half closed. RuleInput carries per-URL fetch outcomes (`urlFetches`), which WEB-073 and POL-015 read deterministically for the brand and policy hosts. This rule covers the opt-in URL, which is often a third address the crawler is not yet asked to fetch, so it stays judged and returns UNCLEAR until a `urlFetches` entry exists for that URL. Recorded rather than omitted: the obligation is real and the remaining gap is the fetch layer's.

Rules you will hit next

Other consent flow rules at the same severity. A registration is judged as a whole, not rule by rule.

CON-008The live CTA and the declared message flow must say the same thingBlockingBLOCKING CON-010The three subscriber-management attributes must be declared trueBlockingBLOCKING CON-013Subscriber attributes must agree with the message bodies suppliedBlockingBLOCKING CON-023Evidence URLs must resolve without a loginBlockingBLOCKING CON-027The opt-in URL must land on a page that carries the opt-inBlockingBLOCKING CON-034The business name on the artifact must match the registered brandBlockingBLOCKING

All consent flow rules

CON-024 is one of 101 consent flow rules in the 915-rule 10DLC registry. Free to cite under CC BY 4.0.