Your DNS records are correct and the verification TXT token matches, but the domain's ownership verification never completed, leaving the certificate stuck. We've kicked off a certificate re-issuance, and it may take a few minutes to complete.