Managed TLS certificate stuck after successful DNS verification

Support
1

Hello,

Site:
keen-pika-bc6c9c.netlify.app

Custom domains:

  • mariaemauro.it — primary domain
  • www.mariaemauro.it — domain alias redirecting to the primary domain

Detail:

- DNSSEC was initially enabled at the Aruba registrar, but it was subsequently
disabled.

DNS configuration:

Issue:
The Netlify-managed TLS certificate is still stuck on “Waiting on DNS propagation”.
The “Retry DNS verification” action consistently returns:
“DNS verification was successful”.

The certificate has still not been provisioned after more than 24 hours from
successful DNS validation, and both custom domains currently show a browser
certificate/security warning over HTTPS.

Checks already completed:

  • Netlify DNS is active.
  • Automatic NETLIFY records exist for both mariaemauro.it and
    www.mariaemauro.it.
  • Both hostnames resolve publicly to Netlify edge IP addresses.
  • Global NS propagation checks return only dns1–dns4.p05.nsone.net.
  • No AAAA records exist for either hostname.
  • No CAA records exist.
  • DNSSEC was initially enabled at the Aruba registrar, but it was subsequently
    disabled.
  • Public DS queries now confirm that no DS record is published.
  • Let’s Debug HTTP-01 test for mariaemauro.it: All OK.
  • Let’s Debug HTTP-01 test for www.mariaemauro.it: All OK.
  • The default keen-pika-bc6c9c.netlify.app hostname works correctly over HTTPS.

Since DNS validation and both HTTP-01 tests are successful, could you please:

  1. inspect the ACME/certificate provisioning logs for this site;
  2. check whether a stale failed authorization or cached DNSSEC failure remains;
  3. check for any Let’s Encrypt rate-limit or internal provisioning error;
  4. manually re-trigger or reset Netlify-managed certificate provisioning?