After waiting for another 6 hours, and having some other issues with our CSP support team, I gave up, removed the custom certificate and domain name, waited another 6 hours, re-added the domain name, waited another 6 hours and re-added the certificate.
All now seems to be back in working order. Moral of the story: patience is a virtue.