Pages HTTPS certificate stuck at "new" for ~14 hours, apex works, www does not, DNS verified

[rsharma-ctrl-bit]

🏷️ Discussion Type

Question

💬 Feature/Topic Area

Pages

Body

Repository: rsharma-ctrl-bit/rsharma-ctrl-bit.github.io
Custom domain: rujjwalsharma.com (apex works over HTTPS; www.rujjwalsharma.com does not)
Plan: GitHub Free

Current state (gh api repos/rsharma-ctrl-bit/rsharma-ctrl-bit.github.io/pages):
https_certificate.state: "new"
https_certificate.domains: ["rujjwalsharma.com", "www.rujjwalsharma.com"]
https_certificate.description: "This domain was recently added. The certificate request process will begin shortly."
https_enforced: false (re-enabling returns "a certificate has not yet been issued for your domain")

DNS already verified clean:

• Four A records at apex point to the documented GitHub Pages IPs (185.199.108/109/110/111.153); no AAAA, ALIAS or extra records
• www is a CNAME to rsharma-ctrl-bit.github.io, confirmed via 1.1.1.1 and 8.8.8.8
• No CAA records restricting issuance; checked directly, Let's Encrypt is permitted
• DNS is on Cloudflare with proxy off (DNS only) for all records
• The pages/health API reports both the apex and www as is_valid: true, is_https_eligible: true, caa_error: null
• Root CNAME file contains only rujjwalsharma.com

Timeline (UTC, Sep 29):

• ~02:45 Custom domain set; a certificate was approved, but it covers only rujjwalsharma.com (not www)
• ~03:48 After changing the domain setting, a new request for both names started and has stayed at "new" ever since
• 11:32 Removed and re-added the custom domain (per the docs); still "new"
• 17:05 Still "new"

A support ticket was auto-closed as self-service (Free plan) before I could get a human response.

The apex domain still serves HTTPS with the older apex-only certificate, but the new certificate that includes www never progresses past "new". Could someone from the Pages team check why this request isn't entering the provisioning queue?

[reddy895]

This looks like a GitHub-side certificate provisioning issue rather than a DNS issue.

GitHub’s documentation says that once DNS validation succeeds, Pages queues a TLS certificate request. Your DNS checks and Pages health status are already showing the domain as valid and HTTPS-eligible, yet the certificate has remained new for many hours.

There are also several recent GitHub Community reports with the same https_certificate.state: "new" behavior despite valid DNS, including reports from September 2026.

At this point, I’d avoid repeatedly removing/re-adding the domain and ask GitHub to inspect the certificate provisioning job for rujjwalsharma.com / www.rujjwalsharma.com.

The details and timeline you've provided are exactly the kind of information that should help the Pages team diagnose it.

[rsharma-ctrl-bit]

Thanks for taking the time to look through the details, really appreciate the second opinion. Given everything points to the provisioning queue rather than DNS, I'll hold off on any more remove/re-add cycles and just wait for someone from the Pages team to take a look. Will update this thread once the certificate state actually moves.

[reddy895]

Thanks for taking the time to go through the details — I really appreciate the second opinion. Since everything points to a provisioning issue rather than DNS, I’ll hold off on any more remove/re-add cycles and wait for the Pages team to take a look.

I’ll update this thread once the certificate status changes.

[rsharma-ctrl-bit]

Update: Ran a few additional diagnostics.

• Checked Certificate Transparency logs via SSLMate's Cert Spotter (crt.sh was returning 502s at the time). Only two certificates have ever been issued for rujjwalsharma.com: one apex-only certificate from Let's Encrypt (the one currently serving the live site), and one apex+wildcard certificate that appears to be Cloudflare's own, unrelated to GitHub Pages. No certificate containing www.rujjwalsharma.com has ever been issued. This suggests the request for www never reached Let's Encrypt at all, the stall is happening inside GitHub's own queue, before certificate issuance is even attempted.
• GET /repos/.../pages/health returned a 202 Accepted with an empty body on this check (the async check was still running), but an earlier call the same day did return a full report showing both rujjwalsharma.com and www.rujjwalsharma.com as is_valid: true and is_https_eligible: true, with no CAA errors.
• The Pages API response's Last-Modified header shows 14:05:30 GMT, after my last manual remove/re-add of the custom domain (around 11:34 GMT), so something touched the Pages configuration on GitHub's side afterward, though https_certificate.state itself hasn't advanced.

Still sitting at state: "new" as of this comment.