Cert first
If HTTPS handshakes fail, Search Console and users both bounce. Confirm A/CNAME records, wait for certificate issuance, then measure LCP/INP on the live .com.
HTTP may show the site while HTTPS is still provisioning — do not declare victory until https:// loads cleanly.