TLS certificates should be quiet infrastructure. They only become interesting when renewal fails.

Check DNS first

Before issuing a certificate, confirm the domain points to the expected host:

dig example.com A