A change on our end inadvertently prevented wildcard custom domains from getting certificates. We've implemented and confirmed a fix. For any wildcard custom domains added to a service between approximately 2025-08-08T16:00Z and 2025-08-12T17:00Z, delete the custom domain and re-add it to the service.