To follow up,
This is working now. The additional delay seems to have been enough to allow things to work right when our system attempted to re-issue the certificate.
Generally, the reason we are unable to provision a complete SSL certificate for your custom domain is that the DNS cache time to live (TTL) value for a record has not had time to expire (from your old settings) before you tried to use it with Netlify. Our SSL provider (https://letsencrypt.org) is unable to create certificates for names that have old cached values still in effect.
I’m not sure what was happening, but the issue is resolved. However, I think something else was contributing to the problems as well.
I was receiving the following error from an ALIAS I added:
Domain has multiple A records
While I’m not 100% the ALIAS and the propagation issue was related, it seemed to resolve about 30 minutes after I removed it.
I opened a new ticket for the ALIAS issue as I think it warranted a separate thread: