This mismatch is almost always DNS plus certificate names, not "the site is down". I treat it as three checks in order: does the bare name resolve to the same edge IP as www, does the nginx server_name (or proxy Host) accept that exact name, and does the certificate SAN cover both.

If only www has an A/AAAA and apex is missing, browsers hang or hit a registrar parking page. If both resolve but the cert is only for www, apex shows a name mismatch. Fix by covering both names on one cert (or two vhosts with a 301 to the canonical host), keep HTTP-01 reachable on port 80 for both names during renewals, and verify with curl -I on both the apex hostname and the www hostname until one redirects cleanly and the other serves the padlock without a bounce loop.