In Project → Settings → Domains, a domain with "Failed To Generate Cert" displayed this as the error detail:
Windows/10.0.20348 cosmos-netstandard-sdk/3.18.0

That's a user-agent string — Windows Server 2022 and the Azure Cosmos DB .NET SDK. It has no relationship to the domain, the project, or anything in the stack. It looks like an unrelated value is being rendered into that field.
The real cause was a DNS misconfiguration, which was fine once found — but the error text sent me looking in entirely the wrong direction first.
Worth fixing, and worth having that field state the actual reason instead.