Hi, my site’s Let’s Encrypt certificate expired on 27 June and will not renew. Visitors get a “your connection is not private” warning, worst on the www address.
Project (site name): precious-frangipane-4d2d63
Team: Career Blueprint (chris-d7gmj74)
Custom domain: thecareerblueprint.app (and www.thecareerblueprint.app)
The SSL/TLS panel shows this on every renew attempt:
SniCertificate::CertificateValidationError: Unable to verify challenge for *.thecareerblueprint.app: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.thecareerblueprint.app - check that a DNS record exists for this domain
The current certificate is a Let’s Encrypt wildcard (*.thecareerblueprint.app plus the apex), created 29 Mar, last updated 28 May, expired 27 Jun.
What I have already verified and tried:
- The domain is on Netlify DNS. Nameservers are delegated to dns1-4.p09.nsone.net and this is fully propagated (confirmed via external NS queries).
- The Netlify DNS zone has the correct records: NETLIFY records for both thecareerblueprint.app and www.thecareerblueprint.app pointing to the site, plus MX and SPF records for email. There are no stale _acme-challenge TXT records in the zone.
- I have clicked “Renew certificate” several times over a few hours; every attempt fails identically with the error above.
- Watching the zone from outside throughout, the _acme-challenge.thecareerblueprint.app TXT record is never published, so Let’s Encrypt correctly returns NXDOMAIN. It looks like Netlify is not writing the DNS-01 challenge record into the zone before validating.
This looks like an inactive or broken DNS zone that needs intervention from your side. Could you please re-provision the DNS zone and force-reissue the certificate? A standard (non-wildcard) certificate for thecareerblueprint.app and www.thecareerblueprint.app is completely fine if that is simpler to unstick. Thank you!