Clear Let's Encrypt error flag if auto ssl is disabled

app/models/pages_domain.rb

@@ -13,6 +13,8 @@ class PagesDomain < ApplicationRecord
   has_many :acme_orders, class_name: "PagesDomainAcmeOrder"
   has_many :serverless_domain_clusters, class_name: 'Serverless::DomainCluster', inverse_of: :pages_domain
 
+  before_validation :clear_auto_ssl_fauilure, unless: :auto_ssl_enabled
+
   validates :domain, hostname: { allow_numeric_hostname: true }
   validates :domain, uniqueness: { case_sensitive: false }
   validates :certificate, :key, presence: true, if: :usage_serverless?
@@ -208,6 +210,10 @@ class PagesDomain < ApplicationRecord
     Pages::VirtualDomain.new([project], domain: self)
   end
 
+  def clear_auto_ssl_fauilure
+    self.auto_ssl_failed = false
+  end
+
   private
 
   def pages_deployed?

spec/models/pages_domain_spec.rb

@@ -536,6 +536,24 @@ describe PagesDomain do
                      'user_provided', 'gitlab_provided')
   end
 
+  describe '#save' do
+    context 'when we failed to obtain ssl certificate' do
+      let(:domain) { create(:pages_domain, auto_ssl_enabled: true, auto_ssl_failed: true) }
+
+      it 'clears failure if auto ssl is disabled' do
+        expect do
+          domain.update!(auto_ssl_enabled: false)
+        end.to change { domain.auto_ssl_failed }.from(true).to(false)
+      end
+
+      it 'does not clear failure on unrelated updates' do
+        expect do
+          domain.update!(verified_at: Time.now)
+        end.not_to change { domain.auto_ssl_failed }.from(true)
+      end
+    end
+  end
+
   describe '.for_removal' do
     subject { described_class.for_removal }