Let's Encrypt certificate stuck for 16+ hours (Netlify DNS) - Let's Debug reports zero problems

Support
1

Site name: scintillating-puppy-6195bf
Custom domain: facefood.bg (with www.facefood.bg as an alias)
DNS type: Netlify DNS - nameservers delegated at the registrar

PROBLEM
No Let’s Encrypt certificate has been issued after more than 16 hours.
The SSL/TLS panel keeps alternating between “DNS verification was
successful” and “Waiting on DNS propagation”, and has also shown
“facefood.bg doesn’t appear to be served by Netlify” several times.
The site itself serves correctly over HTTP - only the certificate is
missing.

KEY EVIDENCE
Let’s Debug (which runs the same validation checks Let’s Encrypt does)
reports ZERO problems for both names:

So from Let’s Encrypt’s side the domain is fully ready for issuance.
This points at the provisioning job being stuck on your end.

TIMELINE (UTC+3)
2 Sep 17:11 - domain added, Netlify DNS zone created
2 Sep 17:22 - nameservers changed at the registrar to dns1-4.p09.nsone.net
2 Sep 19:02 - first “DNS verification was successful”
2 Sep 19:44 - “DNS verification failed”
2 Sep 21:15 onwards - alternating success / “waiting on propagation”
3 Sep 09:47 - still no certificate

ALREADY CHECKED (all items from your SSL troubleshooting guide)

  1. Registrar delegation verified by querying the .bg registry directly
    (a.nic.bg): returns exactly dns1-4.p09.nsone.net, nothing else. No
    leftover nameservers from the previous provider.
  2. All four Netlify nameservers answer authoritatively for the zone.
  3. Google (8.8.8.8) and Cloudflare (1.1.1.1) both return the same four
    nameservers, TTL 3600.
  4. CAA records: none.
  5. AAAA records: none, on either the apex or www.
  6. DNSSEC: not enabled (no DS records at the registry).
  7. The apex resolves to 35.157.26.135 and 63.176.8.218. I tested each
    individually with Host: facefood.bg - both return HTTP 200 with
    Server: Netlify and the correct site content.
  8. www.facefood.bg resolves to the same two addresses.
  9. http://facefood.bg/.well-known/acme-challenge/ returns a
    normal 404, so nothing blocks the challenge path.
  10. netlify.toml has no catch-all redirect - every rule targets a
    specific path (/en/, /i18n/, and individual files).
  11. The DNS zone in Netlify contains exactly two records, both of type
    NETLIFY, for the apex and www. No external A records anywhere, so
    there is no Netlify-DNS / external-DNS conflict.

REQUEST
Could you check whether the certificate provisioning job is stuck for
this site and re-trigger it?

This looks like the known “stuck provisioning job” pattern - the same
alternating success / waiting loop other users have reported, which
needed a backend state flush by Netlify staff. Could you please perform
that reset for this site?

2

Update: this has now been stuck for over 50 hours. The domain was added on Sep 2.

Additional verification since my original post:

“Verify DNS configuration” returns “DNS verification was successful” every time, but reverts to “Waiting on DNS propagation” within the hour and no certificate is ever issued.

Could someone from the Netlify team please provision the certificate manually, or tell me what is blocking it?