GitHub Pages: HTTPS certificate for www.incd.it + incd.it stuck in "new" since Nov 5 (survives removing the domain and re-creating the site)

[maggiomusic]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Pages

Body

Hi,

The HTTPS certificate for my GitHub Pages site has been stuck in state "new" since 5 November 2026. Nothing I can do on my side creates a fresh request, so I think it needs a reset by GitHub staff.

Site

• Repository: maggiomusic/incd.it (built from branch main, root)
• Custom domain: www.incd.it (the apex incd.it should redirect to www)
• GET /repos/maggiomusic/incd.it/pages returns https_certificate with state "new", domains ["www.incd.it", "incd.it"], expires_at "2027-02-02", description "This domain was recently added. The certificate request process will begin shortly."

DNS (authoritative servers dns109.ovh.net / ns109.ovh.net)

• incd.it: A 185.199.108.153, 185.199.109.153, 185.199.110.153, 185.199.111.153 and AAAA 2606:50c0:8000::153 to 2606:50c0:8003::153
• www.incd.it: CNAME maggiomusic.github.io
• No CAA records, no DNSSEC, no other records on these names
• Pages health check: both names are valid and HTTPS-eligible (the apex shows peer_failed_verification only because it has no certificate yet)

What happened (times in UTC)

1. 4 Nov, 21:32: I set www.incd.it as the custom domain. At that moment the apex still had an old AAAA record pointing to the previous host, so a certificate was issued for www.incd.it only (approved at 21:33). The AAAA record was corrected shortly after.
2. 5 Nov, 10:38: I switched the primary domain to incd.it to get the apex added, and the state became "dns_changed". At 10:43 the primary was switched back to www.incd.it while that was still in progress. Since then the request has been "new" and has never moved.
3. 5, 7 and 8 Nov: I removed and re-added the custom domain several times (waiting from 75 seconds to 5 minutes) and briefly switched the primary again. Each time the same "new" record came back immediately, with the same expires_at.
4. 9 Nov, 09:34: I unpublished the Pages site and created it again. The same "new" record was attached again within seconds.

Today https://www.incd.it works with the older www-only certificate, but https://incd.it fails with a certificate name mismatch and I cannot enable "Enforce HTTPS". I am also worried that this stuck record will block the renewal of the www certificate before it expires on 2 Feb 2027.

Could someone from GitHub please clear the stuck certificate record for www.incd.it / incd.it, so that a new request can start? I opened support ticket 4972987, but it was closed automatically because my account is on the Free plan, and I was pointed here.

Thank you!

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[nikoladimitrov98]

I checked your setup from outside, and everything on your side is correct:

• incd.it: the four GitHub Pages A records and the four AAAA records, nothing else.
• www.incd.it: CNAME to maggiomusic.github.io.
• CAA: none on incd.it. www.incd.it follows its CNAME to maggiomusic.github.io, whose CAA records allow letsencrypt.org, so nothing blocks issuing a certificate.
• No DNSSEC (no DS record).
• http://www.incd.it returns 200, http://incd.it returns a 301 redirect, and the CNAME file in the repo says www.incd.it.

One detail explains why removing and re-adding the domain never helps. The certificate served on https://www.incd.it right now is from Let's Encrypt, covers only www.incd.it, and expires 2 Feb 2027 20:33 UTC. The stuck record from the Pages API has "expires_at": "2027-02-02", the same date. So the "new" record doesn't seem to be a fresh request. It looks like your existing www certificate record with incd.it added to its domain list during the primary-domain switch on 5 Nov, and it was never processed after that. Since it's tied to a certificate that is still valid, re-adding the domain or re-creating the site keeps attaching the same record, which matches what you saw.

It also isn't the GitHub Pages incident from 4 Nov. That ran 15:49–17:55 UTC, and your www certificate was issued fine at 21:33 that evening.

There's nothing left to try from your side, so this needs GitHub staff to clear the record and let a new request start for both names. I'd stop switching the primary domain in the meantime, so the record doesn't change again before someone looks at it. If staff pick this up, the useful facts are the state new, expires_at 2027-02-02 matching the live www certificate, and the 10:38/10:43 UTC primary switch on 5 Nov.

[maggiomusic]

Thanks a lot for checking and for the clear explanation, it matches what I found. I won't touch the custom domain or the primary domain anymore, so the record stays exactly as it is for whoever from GitHub can look at it.