Comment (by Roland Haas):

Indeed if we had a DNS A entry from cactuscode.org to einsteintoolkit.github.io then both https://cactuscode.org and https://www.cactuscode.org should result in the same website being delivered. GitHub is not fully clear on this on https://docs.github.com/en/pages/configuring-a-custom-domain-for-your-github-pages-site/about-custom-domains-and-github-pages#using-an-apex-domain-for-your-github-pages-site where they state

For example, if you configure www.example.com as the custom domain for your site, and you have GitHub Pages DNS records set up for the apex and www domains, then example.com will redirect to www.example.com. Note that automatic redirects only apply to the www subdomain. Automatic redirects do not apply to any other subdomains, such as blog

‌

--
Ticket URL: https://bitbucket.org/einsteintoolkit/tickets/issues/2536/certificate-for-https-cactuscodeorg-is-not