What happens to a Replit custom domain's HTTPS certificate when a CAA record is added after issuance?

When a custom domain is configured on Replit and a Let's Encrypt certificate is active, the platform relies on the domain's DNS A or CNAME records pointing to its servers and on the absence of CAA restrictions that would block Let's Encrypt. If a CAA record is later added that excludes Let's Encrypt, the existing certificate remains technically valid until its expiration date, but Replit's automated renewal process may be affected.

What specific status does Replit display for the domain during the renewal attempt after such a CAA change? Does the platform attempt to renew the certificate and, if it fails, does it retain the old certificate until expiry or immediately mark the domain as insecure? Is there any diagnostic information in the Replit UI that indicates the renewal failure is due to a CAA restriction?