Pages HTTPS stuck bad_authz for goose.maniak.ai (DNS OK, verified) — please re-kick ACME

[sebbycorp]

Summary

GitHub Pages custom domain goose.maniak.ai for repo sebbycorp/k8s-goose is stuck in:

https_certificate.state = bad_authz
description = "The ACME authorization is in a bad state. We need to start over."

HTTP works. HTTPS serves the default *.github.io certificate (hostname mismatch). Enforce HTTPS cannot be enabled.

No certificate for goose.maniak.ai has ever appeared in public CT logs (crt.sh returns 0).

DNS (looks correct)

goose.maniak.ai.  CNAME  sebbycorp.github.io.
sebbycorp.github.io. A  185.199.108.153 / .109 / .110 / .111

• Domain ownership: protected_domain_state: verified
• GitHub Pages challenge TXT present: _github-pages-challenge-sebbycorp.goose.maniak.ai
• CAA on parent maniak.ai: empty (allows all CAs)
• No DNSSEC

What we already tried

1. Remove/re-add custom domain via API and UI
2. DELETE then POST recreate entire Pages site
3. Wait/poll after each re-add (immediately returns bad_authz)
4. Confirmed site builds and serves over http://goose.maniak.ai/

Related: iceman.maniak.ai (another Pages subdomain on the same parent) also never got a LE cert. maniak.io apex Pages cert is approved and works.

Ask

Could a Pages engineer kick / reset the ACME authorization for goose.maniak.ai?

Repo: https://github.com/sebbycorp/k8s-goose/settings/pages
Site: http://goose.maniak.ai/

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.