Hello,
There are a few reasons domain verification could be failing. Check that your SSL certificate supports TLS 1.2 with one of these cipher suites:
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_RSA_WITH_AES_128_GCM_SHA256
TLS_RSA_WITH_AES_128_CBC_SHA256
OpenSSL has utilities to check for Cipher suites or your certificate authority should be able to tell you what type of ciphers your certificate is created with.
Also make sure that Apple servers can reach your server to perform domain verification. If required, please allow the following Apple IPs access to your server:
17.150.31.53
17.151.140.51
17.160.220.37
17.160.220.39
One way to make sure that Apple servers are reaching your domain is to configure the access logs on your server to be as verbose as possible. Then perform the domain verification and ensure that one of these IPs is making it to your server for verification. If there is a failure in reaching your server then the access logs should be able to provide more insight on this.
One other common issue with domain verification is proxies that sit in front of your server. If there is a proxy that your server communicates with and the Apple servers cannot go directly to the server where the domain, this has been known to cause issues as well.
Please note that your domain verification file will expire after 7 days.
Matt Eaton
DTS Engineering, CoreOS
meaton3 at apple.com