Your domain is missing its TXT ownership-verification record entirely, and the CNAME points to a stale target from a previous domain entry, which is why the certificate has not advanced. At your DNS provider (Squarespace), add a TXT record using the host and value shown under your service's Settings, Networking section (the verification record details are listed there alongside the CNAME target), and update the CNAME to the current target shown in that same panel. The CNAME changed because the domain entry was recreated at some point, which generates a new random target each time. Verification and certificate issuance resume automatically once both corrected records propagate.