Custom domain TLS stuck after two fully propagated cutover attempts — internal ACME state inspection needed

Support
1

Hello Netlify staff,

Please have a Netlify staff member inspect the internal custom-domain verification and ACME/Let’s Encrypt order state for this site:

  • Netlify site: maison-arriane-production
  • Site ID: 595a2314-5b10-4423-ba00-8d91f2e3881e
  • Custom domain: system.byarriane.com
  • Required Netlify target: maison-arriane-production.netlify.app
  • Preserved deploy SHA: 59335d1ff55e97ee220e300c4d2ebb99611517a8

We performed two controlled Production cutover attempts. Both failed at Netlify custom-domain verification/TLS and were rolled back immediately. The existing Production service is currently healthy on its previous host.

On the second attempt:

  • Cloudflare was configured as DNS-only with a 300-second TTL.
  • After a complete TTL, Cloudflare authoritative DNS, 1.1.1.1, and 8.8.8.8 all returned only maison-arriane-production.netlify.app for system.byarriane.com.
  • There were no conflicting A, AAAA, or CNAME records.
  • There was no restrictive CAA record or relevant DNSSEC blocker.
  • Netlify nevertheless remained at “Waiting on DNS propagation.”
  • HTTPS served Netlify’s default *.netlify.app certificate rather than a certificate covering system.byarriane.com.
  • We restored the previous CNAME, and the current Production system is healthy.

The domain association remains visible in the Netlify dashboard, but there is no control to inspect or reset the certificate order. The Netlify support assistant identified itself as kapa.ai and confirmed it cannot inspect or reset Netlify’s internal ACME state.

Please have a Netlify staff member:

  1. Inspect the internal domain-verification and Let’s Encrypt/ACME order state for Site ID 595a2314-5b10-4423-ba00-8d91f2e3881e.
  2. Reset or clear any stale verification/certificate-order state, if present, without requiring a live DNS change now.
  3. Confirm whether a provider-supported domain detach/re-attach is actually required.
  4. Confirm the minimum uninterrupted period that system.byarriane.com must resolve exclusively to maison-arriane-production.netlify.app for automatic DNS verification and certificate issuance to complete.
  5. Confirm the expected retry interval and the dashboard/API status that proves the certificate is ready before traffic is moved.

We will not attempt another Production cutover until Netlify staff confirms the internal state and required uninterrupted CNAME window. No credentials or sensitive values are included in this post.