Custom domain serving no SSL certificate — HTTPS fails with ERR_CONNECTION_CLOSED

Help
1

Hi — I’m on the Hobby plan, testing a project out, and my custom domain has stopped serving HTTPS. (It was working great for about the first two or three days, but just stopped working today(). Every browser gets ERR_CONNECTION_CLOSED. Hoping the community or staff can help get it unstuck without needing to upgrade yet, since it appears to be a platform-side issue (details below).

Setup: custom subdomain members.investorcollective.io (CNAME to Vercel) on project investor-collective. The investor-collective.vercel.app URL works perfectly.

Symptom: HTTPS to the custom domain fails — the TLS handshake is closed immediately with no certificate presented (“no peer certificate available”). Port 80 returns a bare 403. The dashboard shows the domain as green “Valid Configuration.”

Vercel’s own AI support already looked at it and confirmed it’s an internal certificate-provisioning issue, not something I can fix via DNS or the dashboard. Its findings:

  • canAutoIssue: true — so the domain should be able to provision a cert
  • HTTP ACME challenges verify Vercel’s control fine, but HTTPS serves no certificate
  • It concluded this needs backend intervention and suggested I open a support case — but as a Hobby user I can’t open a ticket without upgrading, which is why I’m here.

What I’ve independently ruled out: DNS is correct (CNAME resolves to Vercel, no stale AAAA); CAA allows Let’s Encrypt + Google Trust Services; the same Vercel edge IPs my domain uses serve the *.vercel.app cert fine (so the edge is healthy, just no cert for my hostname); no incident on the status page.

What I’ve tried (no change): Refresh, removed + re-added the domain once, and redeployed the project. I’ve stopped removing/re-adding to avoid CA rate limits.

Since Vercel’s own diagnostics say the domain is eligible (canAutoIssue: true) but the cert simply isn’t provisioning, could a staff member force a re-issue for members.investorcollective.io, or point me to how to unstick it? Happy to share anything else.

2

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

3

Hi Dustin,

Given what you’ve already checked, I’d avoid more remove/re-add cycles for now. If the dashboard shows Valid Configuration, the CNAME resolves to Vercel, and openssl with the correct SNI still gets no peer certificate, then this is past the usual app-code or route-debugging layer.

I’d capture one clean set while the domain is still failing:

date -u
dig CNAME members.investorcollective.io +short
dig AAAA members.investorcollective.io +short
dig CAA investorcollective.io +short
dig CAA members.investorcollective.io +short

curl -I http://members.investorcollective.io/
openssl s_client -connect members.investorcollective.io:443 -servername members.investorcollective.io -brief </dev/null
curl -I https://investor-collective.vercel.app/

The important parts to include are:

custom domain:
project/deployment URL:
UTC timestamp:
dashboard status:
CNAME result:
CAA result:
HTTP result:
openssl result showing no peer certificate:

If HTTP reaches Vercel but HTTPS resets before any certificate is served, that strongly suggests the request is failing at TLS/certificate serving before it ever reaches your deployment.

I would also avoid posting account/team/project IDs publicly. The domain name and the non-secret command output above should be enough for a public thread; any internal IDs can be shared privately if Vercel asks for them.

4

Thanks so much for the feedback. About a day after I posted this, the SSL certificate seems to have regenerated itself and everything has been working fine with the app since. I don’t know if someone at vercel reset something or the system reset itself after a while, but the issue is now resolved.