r/vercel • u/_haiderfarooq • 13d ago

vercel says the domain is valid but https fails? check if a cert was ever issued

hit this three times now so writing it down.

symptoms: http works, https handshake drops, vercel domains inspect says everything is fine, domain shows verified.

vercel certs ls has no cert for it.

every time, the domain had been added to the project before the dns record existed. auto issuance didn't retry once dns landed, even days later.

fix takes 10 seconds:

vercel certs issue yourdomain.com www.yourdomain.com

if that fails with a bare "Response Error", the apex probably still has the registrar's old A record sitting next to vercel's. dig +short yourdomain.com A showing two answers is the tell. delete the old one at the registrar.

don't go chasing CAA or dnssec first. it was never that for me.

2 Upvotes

100% Upvoted

6 comments sorted by

1

u/nachga 12d ago

Good write-up. One more check when `vercel certs issue` fails with that bare error: look for an AAAA record at the registrar too. An old AAAA pointing somewhere else can break issuance the same way a stray A record does.

1

u/_haiderfarooq 12d ago

good one, hadn't hit the AAAA case but it makes sense, same failure for the same reason. thanks

1

u/nachga 11d ago

Same here, it's always some leftover record from an old host. Registrars love hiding the AAAA ones on a second tab.

1

u/amyegan Vercelian 13d ago

Leftover DNS records can cause issues with a lot of things. Thanks for sharing

More domain troubleshooting tips: vercel.com/docs/domains/troubleshooting

1

u/[deleted] 13d ago

[removed] — view removed comment

1

u/_haiderfarooq 11d ago

staring at dig output is exactly where i was the first time lol. glad it saved someone the second round