Custom domain SSL fails with "wrong version number" despite "Valid Configuration"

bizbasecamp.com and www.bizbasecamp.com (project: bizcamp, team: bizbasecamps-projects) fail TLS handshakes with the error "SSL routines wrong version number" on all 4 resolved edge IPs (64.29.17.65, 64.29.17.1, 216.198.79.1, 216.198.79.65), tested with curl --resolve, forced TLS 1.2, and openssl s_client directly. Dashboard shows "Valid Configuration" for both domains. status.vercel.com shows no incidents. The same deployment works fine at bizcamp.vercel.app.

Proof it's not local/DNS/ISP: another domain on my account (thewellnessregistry.com) on the identical edge IP (216.198.79.1) responds correctly (HTTP/2 308) at the same moment bizbasecamp.com fails on that same IP.

Removed and re-added both domains ~16:15 UTC today to force cert reissuance - no change after 35+ minutes. This looks like the same class of issue as this thread, where a Vercel staff member had to manually reissue the cert: community.vercel.com/t/domain-for-project-mysteriously-stuck-in-generating-ssl-certificate/22894

Could someone from the team take a look at cert provisioning/SNI binding for bizbasecamp.com directly?

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.