GitHub Pages keeps reattaching an expired bad_authz certificate after a full Pages recreation

[AttahirLabs]

GitHub Pages keeps reattaching an expired bad_authz certificate after a full Pages recreation

Repository: https://github.com/AttahirLabs/attahirlabs.com
Custom domains: attahirlabs.com, www.attahirlabs.com

GitHub Pages served an expired certificate on both custom hostnames and the authenticated Pages API remained in this terminal state:

{
  "state": "bad_authz",
  "description": "The ACME authorization is in a bad state. We need to start over.",
  "domains": ["attahirlabs.com", "www.attahirlabs.com"],
  "expires_at": "2026-08-06"
}

Before failing traffic over, both GitHub Pages DNS-health responses were valid and HTTPS-eligible:

• apex: dns_resolves: true, is_pointed_to_github_pages_ip: true, is_served_by_pages: true, is_valid: true, is_https_eligible: true, caa_error: null
• www: dns_resolves: true, is_cname_to_github_user_domain: true, is_served_by_pages: true, is_valid: true, is_https_eligible: true, caa_error: null
• direct HTTP content was served by GitHub Pages, while normal HTTPS failed because the served certificate had expired

Self-service recovery was exhausted:

1. Removed and re-added the custom domain on August 7. The same bad_authz certificate object returned immediately.
2. Repeated a clean remove/wait/re-add after the documented one-hour window. The same state and expiry returned again.
3. On August 8, deleted the complete Pages configuration, verified it was gone, recreated it with the same workflow source, reattached the domain, and redeployed unchanged production commit 1c98f87640f1f2138178ef50e4447a56b85ee784 successfully: https://github.com/AttahirLabs/attahirlabs.com/actions/runs/31257456963
4. The recreated site immediately inherited the identical certificate metadata (bad_authz, expiry 2026-08-06). It was still unchanged five minutes later and remains unchanged in the Pages API.

That full site delete/recreate rules out the repository, build, deployment artifact, and site-level Pages configuration. The stale certificate appears to be keyed at the domain/account level, similar to the additional case documented in https://github.com/orgs/community/discussions/202318#discussioncomment-17729551.

Because this caused a production outage, traffic has now been failed over to Cloudflare Pages, where fresh certificates for both hostnames issued successfully and the same static artifact is serving. DNS therefore no longer points at GitHub Pages, but the GitHub Pages custom-domain binding and its terminal certificate state have been left intact for investigation.

Can a GitHub Pages engineer clear or reinitialize the domain-level certificate record for attahirlabs.com and www.attahirlabs.com? There is no remaining self-service action that resets this object.

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.