Part of the issue @Jimb0 is the configuration for sbs-cli.org isn’t correct.
The apex has the correct A record
% dig sbs-cli.org
sbs-cli.org. 300 IN A 75.2.60.5
The www subdomain also has the same A record
% dig www.sbs-cli.org
www.sbs-cli.org. 300 IN A 75.2.60.5
As noted in the Configure a subdomain section of the Configure external DNS for a custom domain documentation
To point a subdomain such as blog.petsofnetlify.com or www.petsofnetlify.com to your site on Netlify, you must create a CNAME record with your DNS provider.
So you need to remove the A record for the subdomain and replace it with a CNAME record with sbs-cli.netlify.app as the value.
When these changes are made, Let’s Encrypt can provision a certificate.