TLS certificates should be quiet infrastructure. They only become interesting when renewal fails.
Check DNS first
Before issuing a certificate, confirm the domain points to the expected host:
dig example.com A7/5/26Less than 1 minute
Reverse proxies are simple in diagrams and detailed in production.
Forwarded headers
Most applications need the original host, scheme, and client address:
Host
X-Forwarded-For
X-Forwarded-Proto7/4/26Less than 1 minute