Stuck wildcard cert won't switch to standard — Let's Debug passes both methods, site down 3 days**

Help
1

Site: getghostcoach.com (Netlify project: ghostcoach-site)

My Let's Encrypt certificate expired on Aug 5 and will not renew. The site has been down for all visitors for 3 days, showing NET::ERR_CERT_COMMON_NAME_INVALID.

The problem: Netlify is holding a wildcard certificate (*.getghostcoach.com, getghostcoach.com, created May 8) and every renewal attempt tries a DNS-01 challenge that fails:

SniCertificate::CertificateValidationError: Unable to verify challenge for *.getghostcoach.com: DNS problem: NXDOMAIN looking up TXT for _acme-challenge.getghostcoach.com

I do not use any subdomains and do not need a wildcard certificate.

Key evidence — I ran Let's Debug (letsdebug.net) for getghostcoach.com:

  • HTTP-01: "All OK — no issues found."
  • DNS-01: "All OK — no issues found."

So my DNS and domain are fully healthy, and Let's Encrypt can issue a certificate by either method. The failure is not on my end. Yet Netlify's own renewal keeps failing the wildcard DNS-01 challenge with NXDOMAIN — which means Netlify is not successfully writing the _acme-challenge TXT record during issuance, even though my domains show "Netlify DNS" as verified. This appears to be internal to Netlify's certificate pipeline.

What I've already done (every self-serve step):

  • Removed the *.getghostcoach.com wildcard A record from my DNS entirely — there is no wildcard record anywhere in my zone now.
  • Confirmed getghostcoach.com (A → 75.2.60.5) and www.getghostcoach.com resolve correctly; both show "Netlify DNS" verified, and "Verify DNS configuration" passes.
  • Flushed public DNS caches (Google Public DNS) and waited well past my record TTL (14400s).
  • Set www.getghostcoach.com as the primary domain.
  • Confirmed via Let's Debug that both HTTP-01 and DNS-01 validation are healthy (results above).
  • Repeatedly tried "Renew certificate" — it only re-attempts the same stuck wildcard cert, and I've hit the Let's Encrypt authorization-failure rate limit from these retries.

The only blocker is that Netlify keeps attempting the wildcard DNS-01 challenge instead of a standard HTTP-01 certificate, and there is no option in my panel to change the certificate's scope from wildcard to standard. "Renew certificate" cannot fix this because it renews the same broken wildcard cert.

My request: Please delete the stuck wildcard certificate and provision a standard, non-wildcard Let's Encrypt certificate for getghostcoach.com + www.getghostcoach.com via HTTP-01 validation. Let's Debug confirms this will succeed. The site has been down for all users for 3 days — this is urgent. Thank you.

2

Yes, this is definitely something to ask Netlify tech support about.

That is impossible for anyone here to do. Only the person or company that controls the operation of the DNS or server (for HTTP challenge) can get a certificate.

After you get this resolved you should look at some kind of health check or cert monitoring for your site so you don't get surprised by failures. See: Monitoring Service Options - Let's Encrypt