Hi there,
I’m hoping someone can help me figure out what’s happening with SSL provisioning for my custom domain speedtijolosecologicos.com.br on my site speed-tijolo-ecologico.
Timeline: I initially kept DNS at my registrar (registro.br, a Brazilian registrar) with an A record pointing at Netlify’s load balancer and a CNAME for www. Certificate provisioning failed for many hours, and it turned out my registrar had DNSSEC enabled by default (auto-signed via their own nameservers), which was blocking Let’s Encrypt validation.
To fix that, I migrated the whole domain to Netlify DNS (delegated nameservers to dns1-4.p05.nsone.net). I’ve since verified, independently and repeatedly, that DNS is now correct. registro.br confirms the domain is using Netlify’s nameservers with no transition warning. Public DNS lookups via 8.8.8.8 return the correct NS and A records. No DNSSEC DS or DNSKEY records remain anywhere in the chain. The Netlify DNS zone shows the correct records (NETLIFY-type records for both apex and www, pointing at speed-tijolo-ecologico.netlify.app). And “Verify DNS configuration” in the dashboard consistently returns “DNS verification was successful.”
Despite that, clicking “Provision certificate” has failed every time. About 5 attempts now, spaced out over roughly 12+ hours (yesterday evening and again this morning), always with the same generic message: “We could not provision a Let’s Encrypt certificate for your custom domain,” with no further detail given.
Given how many failed attempts happened yesterday while DNSSEC was still misconfigured, I suspect this domain may be stuck in some failed-validation state or rate limit that a UI retry can’t clear. Could someone take a look at the provisioning logs for this domain?
Site name: speed-tijolo-ecologico
Domain: speedtijolosecologicos.com.br
Thanks in advance!