TLS cert generation can fail sometimes and it appears that once it has exhausted our re-tries, there is no way to re-trigger it without re-adding the domain again.

It'd be great if we could detect the final failure state, and display a "Retry" button for users to manually kick off the cert issuance process.