# Wildcard SSL certificate renewal failing (NXDOMAIN) - please issue standard certificate - studioallestero.com

**URL:** <https://answers.netlify.com/t/wildcard-ssl-certificate-renewal-failing-nxdomain-please-issue-standard-certificate-studioallestero-com/165256>\
**Category:** Support\
**Tags:** netlify-dns-https-ssl\
**Created:** [July 16, 2026, 12:51pm UTC](https://answers.netlify.com/t/wildcard-ssl-certificate-renewal-failing-nxdomain-please-issue-standard-certificate-studioallestero-com/165256 "2026-07-16T12:51:31Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![studioallestero](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@studioallestero](https://answers.netlify.com/u/studioallestero)\
**Post date:** [July 16, 2026, 12:51pm UTC](https://answers.netlify.com/t/wildcard-ssl-certificate-renewal-failing-nxdomain-please-issue-standard-certificate-studioallestero-com/165256/1 "2026-07-16T12:51:31Z")

</div>

Hi Netlify team,

My site is studioallestero.netlify.app with custom domain [studioallestero.com](http://studioallestero.com) (with [www.studioallestero.com](http://www.studioallestero.com)). DNS is managed externally at Cloudflare, not Netlify DNS.

My wildcard SSL certificate expires July 15, 2026 (already expired as of now). I am getting this error:

SniCertificate::CertificateValidationError: Unable to verify challenge for \*.studioallestero.com: DNS problem: NXDOMAIN looking up TXT for \_acme-challenge.studioallestero.com

I confirmed my A records in Cloudflare are set to DNS only (proxy disabled), pointing directly to Netlify’s servers. I clicked “Renew certificate” after confirming this, and it failed again with the same NXDOMAIN error. The “Renew certificate” button then disappeared again, leaving only “Set custom certificate.”

I do not need a wildcard certificate — I only use the apex domain and www subdomain, no other subdomains. Please remove the wildcard certificate requirement and issue a standard certificate covering [studioallestero.com](http://studioallestero.com) and [www.studioallestero.com](http://www.studioallestero.com).

The site is currently down for visitors due to the expired certificate. I’d really appreciate urgent help with this. Thank you.

---

<div class="post-metadata">

**Author:** ![studioallestero](https://avatars.discourse-cdn.com/v4/letter/s/a6a055/32.png) [@studioallestero](https://answers.netlify.com/u/studioallestero)\
**Post date:** [August 1, 2026, 10:02am UTC](https://answers.netlify.com/t/wildcard-ssl-certificate-renewal-failing-nxdomain-please-issue-standard-certificate-studioallestero-com/165256/2 "2026-08-01T10:02:48Z")

</div>

\*\*Update: Resolved.\*\*

Root cause turned out to be an \*\*orphaned/inactive Netlify DNS zone\*\* left over from a previous migration (I moved from Netlify DNS to Cloudflare DNS a few months ago, but the old Netlify DNS zone for the domain was never deleted). That leftover zone appears to have caused Netlify’s cert renewal to keep attempting wildcard DNS-01 validation even though my live DNS (Cloudflare) had no way to fulfill it.

\*\*Fix:\*\*

1. Went to Domain management → DNS → found the domain still listed with an old Netlify DNS zone (nameservers [dns1-4.p07.nsone.net](http://dns1-4.p07.nsone.net))

2. Confirmed it was inactive (my registrar’s nameservers actually point to Cloudflare, not Netlify)

3. Deleted the DNS zone under “Danger zone”

4. Waited ~10 minutes, then clicked “Renew certificate”

5. It succeeded — issued a clean \*\*standard certificate\*\* (no wildcard) covering just `studioallestero.com` and `www.studioallestero.com`

Hope it helps anyone else hitting the same NXDOMAIN wildcard error with external DNS - worth checking for a leftover Netlify DNS zone if you’ve ever switched DNS providers on a domain that was previously on Netlify DNS.

---

<div class="post-metadata">

**Author:** ![KirkBater](https://sea1.discourse-cdn.com/netlify/user_avatar/answers.netlify.com/kirkbater/32/82238_2.png) [@KirkBater](https://answers.netlify.com/u/KirkBater)\
**Post date:** [August 24, 2026, 9:22pm UTC](https://answers.netlify.com/t/wildcard-ssl-certificate-renewal-failing-nxdomain-please-issue-standard-certificate-studioallestero-com/165256/3 "2026-08-24T21:22:07Z")

</div>

Thank you for posting the reply to this. I had just done the same thing as part of my troubleshooting this same issue and found that it had also worked.