Netlify site name: sharadaonline.netlify.app (project ID 531af8ab-6e09-4ea9-935d-a32694023398)
Custom domain: sharada.online (primary), www.sharada.online (redirect alias)
Our production site’s Let’s Encrypt certificate expired today (2026-09-02, ~07:03 UTC) and auto-renewal has been failing. Domain Management > HTTPS shows this error:
`SniCertificate::CertificateValidationError: Unable to verify challenge for *.sharada.online: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.sharada.online - check that a DNS record exists for this domain`
Root cause as far as we can tell: the certificate covers both *.sharada.online and sharada.online. Our DNS is authoritatively hosted on Cloudflare (nameservers benedict.ns.cloudflare.com / rosalyn.ns.cloudflare.com), not delegated to Netlify DNS, even though Netlify’s own dashboard shows this domain with a “Netlify DNS” zone on file (added Jun 4) - that zone appears to be inactive/unused in the real world, so the wildcard’s required DNS-01 TXT challenge can never resolve.
We do NOT want to delegate our nameservers to Netlify DNS right now (this domain’s live email - Zoho MX records, SPF/DKIM/DMARC - all live in the same Cloudflare zone, and we’re not comfortable risking that migration just to fix this).
What we’re hoping for: could you reissue/repair the certificate scoped to just sharada.online (and www.sharada.online), dropping the *.sharada.online wildcard? We don’t actually need the wildcard - nothing on our site uses DNS-level subdomains. A non-wildcard cert should be able to renew via an HTTP-01 challenge instead, which doesn’t need any DNS access on your end - our domain already correctly resolves to Netlify’s origin through Cloudflare’s proxy (confirmed: curl to the origin IP presents a valid, if mismatched, Netlify certificate, so the HTTP path itself works fine).
We’ve already re-pointed Cloudflare’s SSL/TLS mode to “Full” (from “Full (strict)”) as a stopgap so the site is back up for visitors in the meantime - so this isn’t a live outage anymore, just something we’d like properly fixed so we can safely switch back to “Full (strict)”.
We also tried generating a Cloudflare Origin CA certificate and installing it via “Set custom certificate,” but the install silently does nothing (no error shown, form just doesn’t submit) - we’re guessing that’s because Origin CA certs aren’t publicly trusted, which is a different problem than the one above, just flagging it in case it’s relevant.
Happy to provide anything else needed. Thanks!