suteo.dev Pages certificate stuck at authorization_created — please requeue issuance

[bysuteo]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Pages

Body

Repository: https://github.com/bysuteo/blog
Custom domain: https://suteo.dev
Alternate domain: https://www.suteo.dev

What I expected

GitHub Pages has already accepted the custom domain. DNS checks are valid and both names are eligible for HTTPS. Pages should finish the Let's Encrypt certificate for suteo.dev and www.suteo.dev, after which HTTPS can be enforced.

What is happening

https_certificate.state is stuck at authorization_created ("Authorization created"). The edge still presents the generic *.github.io certificate, so HTTPS fails the name check. Plain HTTP serves the site.

Checked 2026-10-09 20:02 UTC.

GET /repos/bysuteo/blog/pages:

• cname: suteo.dev
• build_type: workflow
• https_enforced: false
• https_certificate.state: authorization_created
• https_certificate.description: Authorization created
• https_certificate.domains: suteo.dev, www.suteo.dev
• no expires_at (no certificate on the record)

GET /repos/bysuteo/blog/pages/health, both domain and alt_domain:

• is_valid: true
• is_served_by_pages: true
• is_proxied: false
• caa_error: null
• is_https_eligible: true
• responds_to_https: false
• enforces_https: false
• https_error: peer_failed_verification
• apex: is_pointed_to_github_pages_ip true, is_non_github_pages_ip_present false
• www: is_cname_to_github_user_domain true

Live TLS, checked with SNI for both suteo.dev and www.suteo.dev:

• subject CN=*.github.io
• issuer Let's Encrypt YR1
• notBefore 2 Aug 2026, notAfter 31 Oct 2026
• SAN is only *.github.com, *.github.io, *.githubusercontent.com, github.com, github.io, githubusercontent.com
• client error: SSL: no alternative certificate subject name matches target hostname 'suteo.dev'

Already tried

Earlier on 9 October 2026 the custom domain was removed until the certificate record disappeared, then put back. The state returned immediately to authorization_created and has not moved. I am not removing the domain again.

Request

The certificate request is stuck after authorization was created and has not been issued. Please requeue issuance for suteo.dev and www.suteo.dev.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Sagargupta16]

Your DNS is clean from the authoritative side too, so there is nothing left for you to fix. Queried dns1 and dns2.registrar-servers.com directly over UDP and TCP: apex A is the four 185.199.108-111.153, apex AAAA is the four 2606:50c0:800x::153, www is a CNAME to bysuteo.github.io, the SOA serial matches on both servers, and there is no CAA record at suteo.dev or at dev, and no DS record, so no DNSSEC chain to break. bysuteo.github.io itself carries CAA that allows letsencrypt.org. The challenge cannot be failing on your zone.

authorization_created stuck after a clean DNS check is a GitHub-side condition this week, not just yours. #209602 (sigetar.ru) and #209794 report the same state since 2026-10-01 and 2026-10-08. Two useful data points from sigetar.ru:

• Its edge certificate exists now: CN=sigetar.ru, Let's Encrypt, notBefore 2026-10-09 02:37 UTC, about 7 days after that author re-added the domain.
• Its Pages API still says https_certificate.state: authorization_created as of 2026-10-10 01:45 UTC.

So the API state is not a reliable progress indicator for this. Watch the edge instead:

openssl s_client -servername suteo.dev -connect suteo.dev:443 </dev/null 2>/dev/null | openssl x509 -noout -subject -dates

When subject changes from CN=*.github.io to CN=suteo.dev, flip https_enforced on, even if the API state has not moved.

Two things not to do: do not remove and re-add the domain again (it restarts the authorization clock, and your 2026-10-09 re-add is the one that matters now), and do not add a _acme-challenge or CAA record to try to help, since Pages validates over HTTP on the edge and your zone already permits Let's Encrypt. In #208857, GitHub Support confirmed to the author that the configuration was correct and the issuance problem was theirs. For a free account, this thread is the right place to leave it; staff pick up Pages threads here when there is a batch.