Troubleshooting and escalating a systemic failure in Google Cloud's automated domain mapping and SSL certificate provisioning process for a Cloud Run service

Google Cloud Serverless Applications
1

ISSUE: Custom domain mapping for hello.psipy.ai to service hello-psipy-ai has been stuck in PENDING status for over 9 hours. This indicates a failure in the automated SSL certificate provisioning process.

TROUBLESHOOTING PERFORMED (Proving Systemic Issue):

  1. Full Environment Cleanup: The project experienced similar issues previously (18+ hour delays). We performed a comprehensive cleanup, deleting all old services, domains, artifacts, and misconfigured DNS zones (myzone-psipy) to ensure a clean slate.

  2. Clean Deployment: The failing domain is a brand-new, simplest possible deployment (hello.psipy.ai mapped to a test hello-psipy-ai service).

  3. DNS Verification: The CNAME record (hello → ghs.googlehosted.com``.) has been confirmed present and correct in Google Cloud DNS (my-squarespace-domain-zone) since the mapping was created.

  4. Conclusion: Since the issue is replicating immediately in a completely clean environment, the failure is systemic within Google’s provisioning pipeline for the psipy.ai domain, not due to user error or misconfiguration.

REQUEST: Please investigate the internal SSL/Certificate Authority provisioning logs for the domain psipy.ai within Project ID (PII Removed by Staff) and manually trigger or clear the certificate issuance.

2

Ran some more tests: ISSUE: Custom domain mapping is blocked for all new subdomains on psipy.ai. Both hello.psipy.ai (stuck for 12+ hours) and a new test domain, testmap.psipy.ai (stuck after 6 minutes), are failing to provision SSL certificates and are locked in the PENDING status.

TROUBLESHOOTING PERFORMED (Proving Systemic Issue):

  1. Full Environment Cleanup: Project was cleaned of all prior conflicting services and DNS records.

  2. DNS Health Confirmed: All A, AAAA, NS, and CNAME records for the base domain and new subdomains are verified correct and propagating globally. The DNS zone is healthy.

  3. Definitive Test: We created a second, entirely unique mapping (testmap.psipy.ai → hello-psipy-ai). This mapping also immediately failed to proceed past the PENDING stage.

  4. Conclusion: This is a project/domain-wide systemic failure in Google’s automated certificate authority/provisioning pipeline. The block is preventing any new custom domain mapping from finalizing on this domain.

REQUEST: Please investigate the internal SSL/Certificate Authority provisioning logs for the domain psipy.ai within Project ID (PII Removed by Staff) and manually trigger or clear the certificate issuance block.