GitHub Pages TLS for softsys.ge: six hours in new, now dns_changed

[IvanNiukanen]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

We are unable to enable HTTPS for a GitHub Pages custom domain because certificate provisioning has not completed despite valid Pages DNS health.

• Account: IvanNiukanen
• Organization: SoftSys-Expert (GitHub Free)
• Repository: SoftSys-Expert/softsys-ge-site
• Pages source: main, repository root, legacy build
• Current custom domain: www.softsys.ge

As of 2026-09-13 19:14 UTC, the Pages build is successful, but the API reports:

{
  "status": "built",
  "cname": "www.softsys.ge",
  "https_certificate": {
    "state": "dns_changed",
    "description": "Detected a change to DNS settings. Requesting a new certificate.",
    "domains": ["www.softsys.ge", "softsys.ge"]
  },
  "https_enforced": false
}

The authoritative nameservers are ns1.ge and ns2.ge. Authoritative and public resolvers return:

softsys.ge.      1800 IN A     185.199.108.153
www.softsys.ge.  1800 IN CNAME softsys-expert.github.io.

Authoritative checks over UDP and TCP agree. The apex has no AAAA record. Its CAA query returns NOERROR with no CAA data, and there is no DS record. GitHub's domain health reports both hosts with is_valid: true, is_served_by_pages: true, is_https_eligible: true, and caa_error: null.

HTTP currently works: softsys.ge redirects to http://www.softsys.ge, and www.softsys.ge returns 200. Normal TLS verification fails for both names. Direct TLS checks against all four GitHub Pages IPv4 endpoints present a Let's Encrypt certificate for *.github.io, rather than a certificate covering these custom domains.

Timeline:

• At approximately 2026-09-13 12:30 UTC, we performed one documented remove/re-add of the original apex custom domain. The certificate then remained in state: new for about six hours.
• At 2026-09-13 18:49:35 UTC, we changed the Pages custom domain once to www.softsys.ge. This requested one certificate for both www.softsys.ge and softsys.ge and changed the state to dns_changed.
• Twenty-five minutes later, the certificate was still not issued. We performed no further resets or domain changes.

We currently have one apex A record because the DNS provider's UI rejected our attempt to add another with A, AAAA and CName records must be unique. We include this difference without assuming it causes the failure. Another Pages domain in the same organization, softsys.expert, has an approved certificate and working HTTPS.

Could GitHub staff confirm whether any required configuration is missing? If the configuration is valid, could you check whether the certificate provisioning job needs intervention or retrigger it if appropriate?

[github-actions[bot]]

Thank you for your interest in contributing to our community! We currently only accept discussions created through the GitHub UI using our provided discussion templates. Please re-submit your discussion by navigating to the appropriate category and using the template provided.

This discussion has been closed because it was not submitted through the expected format. If you believe this was a mistake, please reach out to the maintainers.