Custom .ru domain — Valid Configuration & SSL issued, but edge never serves it

Help
1

Hi — I have a custom domain issue on a Hobby project that I can’t resolve from my side, and SSL support isn’t available on Hobby, so posting here.

Domain: easyfts.ru (+ www.easyfts.ru) Project: ftslanding Registrar/DNS: Beget (third-party nameservers, not Vercel)

Symptom: The dashboard shows “Valid Configuration” for both easyfts.ru and www.easyfts.ru, and the SSL certificate appears as issued. But the domain never actually loads — I get ERR_CONNECTION_CLOSED on HTTPS, and HTTP doesn’t respond either. The default *.vercel.app domain for the same project works perfectly, so the deployment itself is fine.

DNS configuration (verified via Google DNS 8.8.8.8):

Both records resolve correctly. No CAA records present. Nameservers are correctly delegated to Beget (confirmed via WHOIS).

I’ve already tried: removing and re-adding the domains, refreshing, flushing local DNS, and testing from multiple browsers, devices, and a mobile network — same result everywhere, so it’s not a local cache issue.

The domain was registered fresh (June 5), and DNS propagation has fully completed (over 24h). Everything points to the certificate being issued but never served at the edge.

This looks identical to a recent report for another .ru domain: Custom domain: cert issued but Vercel edge never serves it (no peer cert, port 80 empty) — could this be the same edge-level issue affecting .ru domains?

Could someone from the team take a look? Happy to provide any additional details. Thanks!

2

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

You can also use v0 to narrow down the possibilities.

3

Hi Qjetshk,

Since the .vercel.app deployment works and Vercel shows both DNS and SSL as valid, I’d try to capture whether the connection is failing before or during TLS.

A few checks that would be useful:

dig A easyfts.ru +short
dig CNAME www.easyfts.ru +short
curl -Iv https://easyfts.ru
curl -Iv https://www.easyfts.ru
openssl s_client -connect easyfts.ru:443 -servername easyfts.ru
openssl s_client -connect www.easyfts.ru:443 -servername www.easyfts.ru

If curl connects but TLS fails, the openssl output should show whether Vercel is serving a certificate at all and which certificate name is returned. If the TCP connection closes before any certificate is shown, that points more toward edge/routing/reachability than a normal DNS or CAA issue.

I’d also test the same commands from another network or a remote shell outside your region if possible. If DNS is correct globally but only some networks fail to complete the TLS connection, that is useful evidence to include in the support request.

I would not keep removing/re-adding the domain if the dashboard already shows valid DNS and issued SSL, since that can make the state harder to reason about.