SSL certificate won't provision despite successful DNS verification

Netlify site name: inspiring-pasca-8347e6.netlify.app
Custom domain: sdnegeri034785batugungun.biz.id (+ www.sdnegeri034785batugungun.biz.id)
DNS: Netlify DNS (domain added 8 days ago), NS records fully propagated globally (dns1-4.p01.nsone.net)

The problem:
I cannot provision an SSL certificate for my custom domain. The error shown is:
“We could not provision a Let’s Encrypt certificate for your custom domain.”

Browsers show NET::ERR_CERT_COMMON_NAME_INVALID when visiting the site, because it’s still serving the default *.netlify.app certificate instead of one for my custom domain.

What I’ve already checked/tried:

  • DNS records in Netlify DNS zone are correct: apex and www both have NETLIFY-type records pointing to inspiring-pasca-8347e6.netlify.app
  • Clicked “Verify DNS configuration” - it shows “DNS verification was successful”
  • Clicked “Provision certificate” after successful verification - it still fails with the same error
  • No CAA records exist on the domain (checked via DNSChecker.org) - all locations show no CAA record, so this isn’t a CAA restriction issue
  • This has been failing for over a week

Could someone from the Netlify team help trigger certificate provisioning manually, or let me know what’s blocking it on your end? Thank you.