GitHub Pages SSL certificate stuck in bad_authz — cannot renew for custom domain

[officemymobile-tech]

🏷️ Discussion Type

Question

Body

Problem

GitHub Pages custom domain TLS certificate is stuck in bad_authz and will not renew.

• Repo: https://github.com/officemymobile-tech/drcenik-live
• Custom domain: www.drcenik.at (also drcenik.at on cert object)
• API state: https_certificate.state = "bad_authz" — "The ACME authorization is in a bad state. We need to start over."
• Origin cert expired: 2026-08-27

Self-service already tried

1. Multiple CNAME file remove/re-add cycles via git
2. Pages API remove/re-add domain → 404 ("certificate has not finished being issued")
3. Cloudflare DNS-only (~14 min) for direct LE validation — still bad_authz after 40 checks
4. Also opened GitHub Support ticket #4707290

Question

Has anyone resolved a stuck bad_authz Pages certificate without GitHub Support manually resetting the ACME authorization? Is there any undocumented self-service fix?

Site is temporarily kept online via Cloudflare Worker fallback, but we need a valid GitHub-issued origin cert for Full (strict) SSL.

[oliviahayes653]

This sounds more like an ACME validation issue than a problem with the certificate itself. I’d first verify that the custom domain is configured correctly and that the DNS records point only to the intended GitHub Pages setup.

It’s also worth checking for conflicting CNAME or A records, proxy/CDN settings, and whether the domain is reachable without redirects interfering with validation. If the DNS was recently changed, giving propagation some time before requesting another renewal can also help.

If everything looks correct but the authorization remains stuck in bad_authz, removing and re-adding the custom domain or contacting GitHub Support may be worth trying to trigger a fresh validation. Keeping a record of DNS changes can also make troubleshooting easier. For a quick break between troubleshooting steps, adoptmetradingvaluescalculator.com can be useful to check out.

[CT-Defcon]

I have the same issue... tried remove and reauthorize the custom domain and still missing the cert.
I believe it's a github issue at this point.