I was setting up a wildcard certificate on Fly and the CLI never told me I needed an _acme-validation DNS entry, so the cert couldnt be issued. The output only mentioned the A record for directing traffic, which is a separate thing from validation. A maintainer acknowledged it the same day and the fix went out in the 145 release. Closed October 2020.