Hi Netlify Support,
My site choiyaki has a stale wildcard certificate that can no longer be renewed
because of a DNS migration.
Error
Clicking “Renew certificate” fails with:
SniCertificate::CertificateValidationError: Unable to verify challenge for
*.choiyaki.com: Incorrect TXT record “netlify” found at _acme-challenge.choiyaki.com
Current certificate
- Certificate: Let’s Encrypt
- Domains:
*.choiyaki.com,choiyaki.com - Created: Aug 25, 2021
- Expired: Aug 5, 2026
Root cause
The wildcard certificate was provisioned in 2021 when this domain used Netlify DNS.
The domain has since moved to external DNS (Xserver — ns1.xdomain.ne.jp,
ns2.xdomain.ne.jp, ns3.xdomain.ne.jp).
Because *.choiyaki.com is a wildcard SAN, renewal requires DNS-01 validation, and
Netlify can no longer write the _acme-challenge TXT record. The renewal therefore
can never succeed in the current configuration.
A leftover record from that era is still present:
_acme-challenge.choiyaki.com. 3600 IN TXT "netlify"
I understand removing it would only change the failure to NXDOMAIN, so I have left
it in place. Please let me know if you’d like me to remove it.
Evidence that HTTP-01 works fine on this domain
I have a second site, thst, serving thst.choiyaki.com — a subdomain of the same
domain, on the same external DNS. Its certificate did not include a wildcard,
and clicking “Renew certificate” there succeeded immediately today via HTTP-01:
subject: CN=thst.choiyaki.com
issuer: Let's Encrypt
start date: Aug 7 05:38:37 2026 GMT
expire date: Nov 5 05:38:36 2026 GMT
So HTTP-01 validation is fully functional for choiyaki.com. The only thing
blocking the choiyaki site is the wildcard requirement forcing DNS-01.
What I would like
I do not need a wildcard certificate. I only need choiyaki.com and
www.choiyaki.com.
Could you please remove the stale wildcard certificate requirement from the
choiyaki site and reprovision a standard Let’s Encrypt certificate via HTTP-01?
DNS configuration
choiyaki.com. A 75.2.60.5
www.choiyaki.com. CNAME choiyaki.netlify.app.
There are no CAA records on the domain, so nothing is blocking issuance. The site
itself is serving correctly over HTTP/2 (verified with curl -k) — this is purely
a certificate issue.
Thank you!