Title: Custom Preview domain stuck in TLS provisioning — DNS valid, no certificate presented
Hi,
I have a custom Preview branch domain that appears to be stuck in Vercel-managed TLS certificate provisioning.
Project: dtf-italia
Plan: Hobby
Domain: uat.dtfitalia.it
Git branch: uat/p0-security
Domain type: Preview branch domain
Current Vercel domain state: VALID
Deployment Protection: prod_deployment_urls_and_all_previews
The generated .vercel.app Preview deployment works correctly and is protected.
DNS configuration:
uat.dtfitalia.it CNAME bc2334833b49b902.vercel-dns-017.com
Authoritative nameservers: ns1.dns-parking.com ns2.dns-parking.com
DNS diagnostics:
- authoritative CNAME resolves correctly;
- no direct conflicting A record;
- no AAAA record;
- no conflicting CNAME;
- no _acme-challenge TXT/CNAME;
- Vercel domain configuration reports VALID.
CAA observed for the UAT hostname:
0 issue "letsencrypt.org" 0 issue "pki.goog" 0 issue "sectigo.com" 0 issue "globalsign.com"
The apex has no CAA restrictions.
Let's Encrypt therefore appears allowed.
HTTP test:
http://uat.dtfitalia.it/.well-known/acme-challenge/dtf-test
returns HTTP 404 from:
Server: Vercel
so plain HTTP traffic is reaching Vercel directly and is not being intercepted by another provider/proxy.
TLS test:
openssl s_client -connect uat.dtfitalia.it:443 -servername uat.dtfitalia.it -brief
fails with an unexpected EOF before Vercel presents any certificate.
Vercel currently reports:
TLS: PROVISIONING
There is no explicit certificate-generation error in the domain metadata.
Production domains:
continue to work normally and are public.
No Cloudflare or other reverse proxy is in front of the UAT hostname.
I have intentionally not removed/re-added the domain or changed DNS again because the current DNS configuration is valid and traffic is reaching Vercel.
Could someone from Vercel check whether the managed certificate issuance for uat.dtfitalia.it is stuck internally and retrigger/fix provisioning if necessary?
Thanks.
