TLS and certificates
You can upload certificates or request issuance through ACME. Certificate issuance and certificate activation are separate stages.
Certificate management
DNS ACME supports managed publication and external publication. With external publication, you publish the DNS challenge returned by the API. Check certificate status and the returned DNS challenge, then inspect the public TXT record.
Incoming TLS client-certificate validation and an origin client certificate are separate settings. The first checks clients connecting to your site. The second authenticates Balancer to your origin.
Verify the serving certificate
An active certificate status does not establish that every listener has received it. Check the certificate presented by an actual connection to your site. Client CA validation can reject the TLS handshake before HTTP policy evaluation, so there may be no HTTP status code.
There is no verified fixed issuance or deployment time. See traffic verification.