Check DNS
Pending SSL almost always means the hostname does not resolve to our targets yet. Use a DNS lookup tool from multiple resolvers. Local ISP caches can lie for hours.
CAA records
If your zone has CAA records, allow our certificate authority. Overly strict CAA blocks issuance even when A/CNAME records look perfect.
Rate limits
Repeated failed attempts can hit authority rate limits. Wait and retry after fixing DNS instead of clicking issue repeatedly.
When to contact us
If DNS has been correct for more than a few hours and CAA is open, contact support with the hostname and a dig/nslookup screenshot.