Lightsail failing TLS certificate validation/creation

When your Lightsail SSL/TLS certificate validation fails despite showing a successful validation status initially, there are several potential causes to investigate:

1. CAA Records: If you're using Cloudflare or another DNS provider that automatically adds CAA (Certificate Authority Authorization) records, these might be preventing AWS from issuing certificates for your domain. CAA records restrict which Certificate Authorities can issue certificates for your domains, and if AWS's CA isn't authorized, validation will fail.

2. DNS Propagation: Even though you've added the CNAME record in Route 53, DNS changes can take time to propagate fully. The initial "Success" status might be temporary if the validation can't be consistently verified.

3. Certificate Limits: Check if you've reached any certificate limits for your domain.

4. Record Configuration: Ensure the CNAME record is exactly as specified in the validation details, including the trailing period if present.

To resolve this issue:

1. Check for any CAA records in your Route 53 hosted zone that might be restricting certificate issuance. If present, you'll need to modify them to include Amazon's CA.

2. Verify that the CNAME record is correctly configured and matches exactly what Lightsail requires.

3. Try creating a new certificate after waiting 24-48 hours if you've made multiple attempts.

4. If the issue persists, it may be necessary to contact AWS Customer Support, as mentioned in the troubleshooting documentation for SSL/TLS certificates in Lightsail.
   Sources
   Lightsail Certificates: Certificate validation always fails with external DNS managed by Cloudflare | AWS re:Post
   Lightsail: setup a wordpress site | AWS re:Post
   Troubleshoot SSL/TLS certificates in Lightsail - Amazon Lightsail