“We did not realize (and the alerts didn’t specify) that the configuration would prevent automatic certificate renewal from completing.”
Tailscale moved its site to a host without IPv6, bolted on its own proxy, and ignored the “misconfiguration” alerts for 90 days. Its certificate probers only checked over IPv6, where the proxy had a valid certificate. The docs and install.sh went dark for 90 minutes. The long-term fix is multiple redundant calendar alerts to renew certificates by hand. A networking company lost its own website to an expiry date.