Making the support ticket doesn't work, so here is my issue below drafted by claude.

Project: clean-bee (team: bakhtiyar) Domain: cleanbumblebee.com — purchased through Vercel, Vercel nameservers, dashboard shows "Valid Configuration"

Problem: the TLS certificate was only ever distributed to 1 of the 8 anycast edge IPs. The other 7 reset the connection at Client Hello, so with normal DNS rotation ~50% of visitors got a dead site.

Reproduce from any network:

1
curl -v --resolve cleanbumblebee.com:443:64.29.17.1 https://cleanbumblebee.com
2
→ Connection reset by peer (no certificate served)
3

4
curl -v --resolve cleanbumblebee.com:443:216.198.79.1 https://cleanbumblebee.com
5
→ HTTP/2 200, valid certificate

Per-IP results — identical from three independent networks in three different countries, re-verified today:

1
216.198.79.1    OK 200
2
216.198.79.65   TLS reset
3
216.198.79.129  TLS reset
4
216.198.79.193  TLS reset
5
64.29.17.1      TLS reset
6
64.29.17.65     TLS reset
7
64.29.17.129    TLS reset
8
64.29.17.193    TLS reset

Everything already tried, none of it propagated the cert:

• Domain Refresh in the dashboard
• Domain Remove + re-add
• Forced vercel certs issue cleanbumblebee.com "*.cleanbumblebee.com" (succeeded, cert created)
• A fresh successful production deployment
• CAA allows letsencrypt.org and pki.goog; vercel-status.com all green throughout

Support ticket response claimed the edge was healthy and suggested local network issues — but the official vercel-connect-debug script, run from a different country than mine, produced the 7/8 failure table above. It also captured 216.198.79.1 serving a Let's Encrypt cert while support said the domain serves Google Trust Services — which suggests mixed/stuck cert state across the edge. The ticket then referred me here (Hobby plan).

Current workaround: I added an explicit apex A record pinning the domain to the one healthy IP (216.198.79.1) via Vercel DNS. The site is up, but this sacrifices anycast failover and shouldn't be permanent.

Ask: can someone from Vercel push the certificate to all edge IPs / clear the stuck distribution state for cleanbumblebee.com? Happy to remove the DNS pin as soon as the other IPs serve the cert, and happy to share the full vercel-connect-debug output on request.