The situation:
I was setting up a wildcard certificate on Fly and the CLI never told me I needed an _acme-validation DNS entry, so the cert couldnt be issued. The output only mentioned the A record for directing traffic, which is a separate thing from validation. A maintainer acknowledged it the same day and the fix went out in the 145 release. Closed October 2020.
What actually fixes it (verified in the thread):
Wildcard certs need a DNS-01 challenge, which means an _acme-validation TXT record, but flyctl was only showing the traffic-pointing instructions and skipping the validation step entirely. The fix was in the flyctl 145 release, which added the missing instructions to the certs output. If your wildcard cert is stuck unissued, check you created the _acme-validation record, thats the step the old output omitted.