GitHub Pages custom domain TLS certificate provisioning stuck despite successful DNS check

[DwainYu]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

GitHub Pages custom domain TLS certificate provisioning stuck

Hi GitHub team/community,

I'm having an issue with GitHub Pages custom domain HTTPS provisioning.

Repository

https://github.com/DwainYu/tft-training-log

Custom domain

https://playmaker.bbroot.com/

GitHub Pages shows:

DNS check successful

but HTTPS is still unavailable:

Enforce HTTPS — Unavailable for your site because your domain is not properly configured to support HTTPS

Previously, the status also showed:

TLS certificate is being provisioned
Certificate Request Error: Certificate provisioning will retry automatically in a short period

I have already removed and re-added the custom domain once, but the problem remains.

DNS configuration

The authoritative DNS servers for bbroot.com are:

• a.nic.dnshe.org
• b.nic.dnshe.org

Both authoritative servers return:

playmaker.bbroot.com. 600 IN CNAME dwainyu.github.io.

I also verified that the domain resolves to the GitHub Pages IPv4 and IPv6 addresses.

There are no CAA records for bbroot.com.

Direct TLS inspection

Running:

openssl s_client \
  -connect playmaker.bbroot.com:443 \
  -servername playmaker.bbroot.com \
  </dev/null 2>/dev/null |
openssl x509 -noout -subject -issuer -dates -ext subjectAltName

currently returns a Let's Encrypt certificate for GitHub's default domains:

subject=CN = *.github.io
issuer=C = US, O = Let's Encrypt, CN = YR1

with SANs including:

*.github.com
*.github.io
*.githubusercontent.com
github.com
github.io
githubusercontent.com

but not:

playmaker.bbroot.com

So DNS routing to GitHub Pages appears to work, but the custom-domain certificate has not been provisioned.

What I have verified

• DNS check: successful
• CNAME: playmaker.bbroot.com -> dwainyu.github.io
• Authoritative DNS servers agree
• A/AAAA records resolve to GitHub Pages
• No CAA restriction
• GitHub Actions deployment: successful
• Site content is served over HTTP
• Custom domain HTTPS certificate: not provisioned

Could a GitHub staff member please advise whether the Pages TLS certificate provisioning for this custom domain is stuck or requires an internal reset/retry?

Thanks.

[Fantazer4k]

From the checks u've provided, the DNS configuration looks correct and the fact that GitHub is already serving a *.github.io certificate suggests that the domain is reaching GitHub Pages correctly....
The important part is that the certificate currently being served does not include playmaker.bbroot.com, so this looks more like a GitHub Pages TLS provisioning issue than a DNS issue.
If u've already removed & re-added the custom domain & the DNS check is successful, I would avoid making further DNS changes for now. I'd give the certificate provisioning some time to retry, and if it remains stuck, contact GitHub Support with the Certificate Request Error message and the TLS output you've included here.
There doesn't appear to be a CAA record blocking Let's Encrypt either, so I don't see an obvious DNS-side reason for the certificate request to fail.
its all what ik, good luck!

[reddy895]

The DNS and TLS checks here are pretty conclusive. Since the custom domain resolves correctly and GitHub is serving its default *.github.io certificate, the request is reaching GitHub Pages but the certificate for playmaker.bbroot.com hasn't been issued yet.

If the Pages dashboard continues to show “Certificate Request Error” despite a successful DNS check, this seems worth escalating as a Pages-side provisioning issue rather than changing the DNS configuration again.

I’d keep the current DNS configuration unchanged and provide GitHub Support with the openssl output and the exact certificate-request error. That gives them enough information to check the provisioning state on their side.

[TheJudge26]

You have configured everything perfectly on your end. The DNS is correct, there are no CAA blocks, and your traffic is successfully reaching GitHub's servers.

When you see the "Certificate Request Error" persist even after removing and re-adding the custom domain, it means the Let's Encrypt request is physically stuck in GitHub's backend provisioning queue.

Since the community members here don't have backend access to GitHub's servers, you will need to contact GitHub Support directly to have a staff member manually clear the error and force the certificate to generate.

Next Steps:

1. Go to the GitHub Support Portal.
2. Open a ticket regarding GitHub Pages / Custom Domains.
3. Link them to this exact discussion Your openssl logs and DNS checks are perfect proof that the issue is on their side, which will help them solve it much faster.

Leave your DNS settings exactly as they are right now while you wait for their response.

[Fanxy13]

One thing I would try before opening a support ticket is checking whether the custom domain is still correctly saved in the repository's Pages settings and in the CNAME file, if you're using one.

If both contain playmaker.bbroot.com and GitHub's DNS check is already successful, I wouldn't change the DNS records anymore. The fact that the server is returning GitHub's default *.github.io certificate means the request is reaching GitHub Pages, but the certificate for the custom hostname hasn't been issued yet.

At that point, I'd leave the configuration unchanged and let GitHub retry the certificate provisioning. If it continues showing Certificate Request Error, GitHub Support is probably the right next step because there doesn't seem to be an obvious DNS-side issue here.