If you use Cloudflare, make sure your CNAME record is set to DNS only (the grey cloud icon) and not Proxied (the orange cloud icon).
When a record is proxied, Cloudflare hides your CNAME and serves traffic through its own servers, so we can't see that the record points to mydomain.onelink.to, and can't verify your domain or issue its TLS certificate. Open your Cloudflare DNS settings, find the record for your subdomain, and click the orange cloud so it turns grey. Onelink.to checks the record again about every hour, so verification then completes by itself.
The same applies to other proxy, CDN, or web-firewall services (such as Sucuri, Imperva, or StackPath): disable proxying for this record.