Custom domain spgexpenses.com not serving HTTPS — TLS handshake fails, netlify.app subdomain works

Support
1

Netlify site name: spg-expenses-prod.netlify.app
Custom domain: spgexpenses.com (and www.spgexpenses.com), using Netlify DNS
Plan: paid ($9/month)

PROBLEM
https://spgexpenses.com does not load. Chrome shows:

This site can't provide a secure connection
spgexpenses.com sent an invalid response.
ERR_SSL_PROTOCOL_ERROR

https://spg-expenses-prod.netlify.app loads perfectly, so the deploy itself is fine.
This has been failing continuously for over 2 hours.

WHAT I TESTED

  • http://spgexpenses.com (port 80) works: HTTP/1.1 301 Moved Permanently,
    Server: Netlify, redirecting to https://spgexpenses.com/
  • https://spgexpenses.com (port 443): the TLS handshake never completes. curl returns
    no HTTP status at all. 5 consecutive attempts all failed.
  • Same failure on https://www.spgexpenses.com

DNS

  • spgexpenses.com resolves to 18.204.152.241
  • www.spgexpenses.com resolves to 18.204.152.241
  • spg-expenses-prod.netlify.app resolves to 18.208.88.157 / 98.84.224.111
    (these serve HTTPS fine)

KEY DETAIL
I tested 18.204.152.241 with SNI for spg-expenses-prod.netlify.app instead of my custom
domain, and TLS fails there too. So that IP does not appear to serve HTTPS for any
hostname, while answering normally on port 80. This looks like it may not be
certificate-specific.

CERTIFICATE
The SSL/TLS panel shows everything as valid:

  • Certificate: Let’s Encrypt
  • Domains: *.spgexpenses.com, spgexpenses.com
  • Created: Aug 27, Updated: Aug 30 at 3:20 PM
  • Auto-renews before: Nov 25

I clicked “Renew certificate” and it made no difference — still failing hours later.

Could you check whether the edge node serving 18.204.152.241 is healthy on port 443, or
reassign my custom domain to a working one? Thanks.