SSL is issued automatically once DNS resolves to Alert.to. If your DNS sits behind a proxy, set the record to DNS-only until the certificate is issued, then re-enable the proxy with full SSL.