Firebase Hosting custom domain stuck in certificate provisioning after DNS provider change

Confirmed facts

Firebase Hosting does not automatically re‑validate an existing managed Let’s Encrypt certificate when the authoritative DNS zone for a custom domain changes. The domain entry must be removed and then re‑added to trigger a fresh provisioning cycle.

Likely explanation

After you moved the domain to a new DNS provider, Firebase’s validation servers continue to see the old DNS records (or no records) because the domain entry in the console is still tied to the previous validation attempt. Until the entry is removed and re‑added, Firebase will not request a new certificate, so the status remains “Pending” or “Certificate provisioning”.

Steps to resolve (no unnecessary downtime)

1. Verify global DNS propagation
   • Run dig +short YOUR_DOMAIN from a public resolver (e.g., Google 8.8.8.8) and confirm the A/AAAA/CNAME records match those shown in the Firebase console.
   • Check that the Firebase verification TXT record (firebase-domain-verification=...) is present and matches the value Firebase expects.
2. Ensure CAA records allow Let’s Encrypt
   • Run dig +short CAA YOUR_DOMAIN. If any CAA records exist, they must include issue "letsencrypt.org" or be absent; otherwise Firebase cannot issue a certificate.
3. Remove the domain from Firebase Hosting
   • In the Firebase console, go to Hosting → Custom domains, select the domain, and click “Delete domain”.
4. Re‑add the domain
   • Click “Add domain”, enter the same hostname, and follow the prompts to add the verification TXT record (if it isn’t already present).
5. Monitor the console
   • After re‑adding, the status should move from “Pending” to “Connected” within 10‑60 minutes if DNS is correct.
6. Verify the certificate
   • From a host that bypasses any proxy/CDN, run:
   • openssl s_client -connect YOUR_DOMAIN:443 -servername YOUR_DOMAIN
   • Check the certificate’s issuer – it should be “Let’s Encrypt” and the validity dates should reflect a recent issuance.

Missing diagnostic detail that could change the recommendation

If you observe a certificate issued by a different authority (e.g., your CDN or a reverse proxy) when running the openssl s_client command, the issue may be upstream TLS termination rather than Firebase’s provisioning. In that case, you would need to adjust the upstream TLS configuration instead of (or in addition to) re‑adding the domain in Firebase.

Please confirm: When you inspect the certificate directly from a network path that bypasses any proxy, does the issuer show Let’s Encrypt or another entity?