Wildcard SSL certificate renewal failing (NXDOMAIN) - please issue standard certificate - studioallestero.com

Support
1

Hi Netlify team,

My site is studioallestero.netlify.app with custom domain studioallestero.com (with www.studioallestero.com). DNS is managed externally at Cloudflare, not Netlify DNS.

My wildcard SSL certificate expires July 15, 2026 (already expired as of now). I am getting this error:

SniCertificate::CertificateValidationError: Unable to verify challenge for *.studioallestero.com: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.studioallestero.com

I confirmed my A records in Cloudflare are set to DNS only (proxy disabled), pointing directly to Netlify’s servers. I clicked “Renew certificate” after confirming this, and it failed again with the same NXDOMAIN error. The “Renew certificate” button then disappeared again, leaving only “Set custom certificate.”

I do not need a wildcard certificate — I only use the apex domain and www subdomain, no other subdomains. Please remove the wildcard certificate requirement and issue a standard certificate covering studioallestero.com and www.studioallestero.com.

The site is currently down for visitors due to the expired certificate. I’d really appreciate urgent help with this. Thank you.

2

**Update: Resolved.**

Root cause turned out to be an **orphaned/inactive Netlify DNS zone** left over from a previous migration (I moved from Netlify DNS to Cloudflare DNS a few months ago, but the old Netlify DNS zone for the domain was never deleted). That leftover zone appears to have caused Netlify’s cert renewal to keep attempting wildcard DNS-01 validation even though my live DNS (Cloudflare) had no way to fulfill it.

**Fix:**

1. Went to Domain management → DNS → found the domain still listed with an old Netlify DNS zone (nameservers dns1-4.p07.nsone.net)

2. Confirmed it was inactive (my registrar’s nameservers actually point to Cloudflare, not Netlify)

3. Deleted the DNS zone under “Danger zone”

4. Waited ~10 minutes, then clicked “Renew certificate”

5. It succeeded — issued a clean **standard certificate** (no wildcard) covering just `studioallestero.com` and `www.studioallestero.com`

Hope it helps anyone else hitting the same NXDOMAIN wildcard error with external DNS - worth checking for a leftover Netlify DNS zone if you’ve ever switched DNS providers on a domain that was previously on Netlify DNS.