Failed to Generate Cert after DNS NXDOMAIN was resolved – www.cozumelopina.mx - Help

Hello,

I need help with a custom domain that is stuck on “Failed To Generate Cert”:

www.cozumelopina.mx

The original certificate attempt failed because of an NXDOMAIN issue at my DNS provider (NEUBOX). We identified that their authoritative nameservers were returning inconsistent results.

NEUBOX has now corrected the issue by changing the domain delegation and leaving the authoritative nameserver that correctly serves the DNS zone.

We have verified the DNS directly:

Authoritative DNS: ns301.cloud-mx-ns.net

correctly returns: www.cozumelopina.mx CNAME 480290224c83f422.vercel-dns-017.com

Google Public DNS (8.8.8.8) now also correctly returns: www.cozumelopina.mx CNAME 480290224c83f422.vercel-dns-017.com

The apex domain cozumelopina.mx is shown as Valid Configuration in Vercel, and the Vercel domain cozumel-opina.vercel.app is also working correctly.

However, Vercel still shows the previous certificate error:

Failed To Generate Cert

with the old:

http-01 challenge failed / DNS problem: NXDOMAIN looking up A and AAAA for www.cozumelopina.mx

We have refreshed the domain several times after DNS resolution was corrected, but Vercel still appears to retain the previous failed certificate state.

Could someone from the Vercel team please clear/retry the failed certificate state or manually trigger/reissue the SSL certificate for www.cozumelopina.mx?

DNS is now publicly resolving correctly.

Thank you very much.

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.

Update: I also ran the HTTP-01 validation test for www.cozumelopina.mx using Let's Debug, as recommended in Vercel's domain troubleshooting documentation.

The result is “All OK! — No issues were found with www.cozumelopina.mx.”

I also verified that an HTTP request to /.well-known/acme-challenge/test reaches Vercel successfully (Server: Vercel), and there are no restrictive CAA records or stale _acme-challenge DNS records.

At this point DNS and HTTP-01 validation appear to be working correctly, but Vercel continues showing the previous “Failed To Generate Cert” / NXDOMAIN error.

Could the certificate issuance please be retried/reset on Vercel's side?

UPDATE — SOLVED ✅

I’m posting the final solution in case someone else runs into the same issue.

In our case, the original “Failed To Generate Cert” error was caused by inconsistent DNS responses from our DNS provider’s authoritative nameservers. Some nameservers returned the correct CNAME for www, while others returned NXDOMAIN.

Our DNS provider eventually corrected the authoritative DNS issue. After that, we verified that:

www.cozumelopina.mx resolved publicly to the correct Vercel CNAME.

www.cozumelopina.mx

cozumel-opina

Enables anonymous real-time citizen voting on local issues with instant results and historical data, fostering transparent community participation.

Google Public DNS (8.8.8.8) resolved it correctly.
An HTTP request to /.well-known/acme-challenge/test successfully reached Vercel.
Let’s Debug reported “All OK!” for HTTP-01 validation.

However, the Vercel dashboard continued showing the old:

Failed To Generate Cert

with the previous NXDOMAIN / HTTP-01 challenge error, even after refreshing the domain several times.

WHAT FINALLY FIXED IT

I installed the Vercel CLI, logged into the account/team that owns the project, and manually triggered a new certificate issuance:

vercel certs issue cozumelopina.mx www.cozumelopina.mx

Vercel responded:

Success! Certificate entry for cozumelopina.mx, www.cozumelopina.mx created

I then checked it with:

vercel certs ls

and confirmed that a new certificate had been issued containing both domains:

cozumelopina.mx www.cozumelopina.mx

with automatic renewal enabled.

Finally, I tested:

curl -I https://www.cozumelopina.mx

and received:

HTTP/1.1 200 OK

After refreshing the Vercel dashboard, www.cozumelopina.mx changed from:

Failed To Generate Cert

to:

Valid Configuration ✅

CONCLUSION

If your DNS previously returned NXDOMAIN, you fix the DNS problem, public DNS and HTTP-01 validation are now working correctly, but Vercel still shows the old “Failed To Generate Cert” error, manually issuing the certificate through the Vercel CLI may resolve the stuck certificate state.

IMPORTANT:

Do not treat the CLI command as a workaround for broken DNS.

Before manually issuing the certificate, make sure the underlying DNS problem is actually resolved.

In our case, we first confirmed:

The authoritative DNS was returning the correct CNAME.
Google Public DNS (8.8.8.8) was resolving the domain correctly.
HTTP traffic was successfully reaching Vercel.
HTTP-01 validation passed using Let’s Debug.

Only after all of those checks passed did we manually trigger the certificate issuance.

The command that finally solved the stuck certificate state was:

vercel certs issue cozumelopina.mx www.cozumelopina.mx

Hope this saves someone else the time we spent troubleshooting it! 🙂

Hello,

I need help with a custom domain that is stuck on “Failed To Generate Cert”:

www.cozumelopina.mx

The original certificate attempt failed because of an NXDOMAIN issue at my DNS provider (NEUBOX). We identified that their authoritative nameservers were returning inconsistent results.

NEUBOX has now corrected the issue by changing the domain delegation and leaving the authoritative nameserver that correctly serves the DNS zone.

We have verified the DNS directly:

Authoritative DNS: ns301.cloud-mx-ns.net

correctly returns: www.cozumelopina.mx CNAME 480290224c83f422.vercel-dns-017.com

Google Public DNS (8.8.8.8) now also correctly returns: www.cozumelopina.mx CNAME 480290224c83f422.vercel-dns-017.com

The apex domain cozumelopina.mx is shown as Valid Configuration in Vercel, and the Vercel domain cozumel-opina.vercel.app is also working correctly.

However, Vercel still shows the previous certificate error:

Failed To Generate Cert

with the old:

http-01 challenge failed / DNS problem: NXDOMAIN looking up A and AAAA for www.cozumelopina.mx

We have refreshed the domain several times after DNS resolution was corrected, but Vercel still appears to retain the previous failed certificate state.

Could someone from the Vercel team please clear/retry the failed certificate state or manually trigger/reissue the SSL certificate for www.cozumelopina.mx?

DNS is now publicly resolving correctly.

Thank you very much.

https://vercel.com/docs/domains/troubleshooting

vercel.com

Troubleshooting domains

Learn about common reasons for domain misconfigurations and how to troubleshoot your domain on Vercel.

Update: I also ran the HTTP-01 validation test for www.cozumelopina.mx using Let's Debug, as recommended in Vercel's domain troubleshooting documentation.

The result is “All OK! — No issues were found with www.cozumelopina.mx.”

At this point DNS and HTTP-01 validation appear to be working correctly, but Vercel continues showing the previous “Failed To Generate Cert” / NXDOMAIN error.

Could the certificate issuance please be retried/reset on Vercel's side?

UPDATE — SOLVED ✅

I’m posting the final solution in case someone else runs into the same issue.

Our DNS provider eventually corrected the authoritative DNS issue. After that, we verified that:

www.cozumelopina.mx resolved publicly to the correct Vercel CNAME.

www.cozumelopina.mx

cozumel-opina

Enables anonymous real-time citizen voting on local issues with instant results and historical data, fostering transparent community participation.

Google Public DNS (8.8.8.8) resolved it correctly.
An HTTP request to /.well-known/acme-challenge/test successfully reached Vercel.
Let’s Debug reported “All OK!” for HTTP-01 validation.

However, the Vercel dashboard continued showing the old:

Failed To Generate Cert

with the previous NXDOMAIN / HTTP-01 challenge error, even after refreshing the domain several times.

WHAT FINALLY FIXED IT

I installed the Vercel CLI, logged into the account/team that owns the project, and manually triggered a new certificate issuance:

vercel certs issue cozumelopina.mx www.cozumelopina.mx

Vercel responded:

Success! Certificate entry for cozumelopina.mx, www.cozumelopina.mx created

I then checked it with:

vercel certs ls

and confirmed that a new certificate had been issued containing both domains:

cozumelopina.mx www.cozumelopina.mx

with automatic renewal enabled.

Finally, I tested:

curl -I https://www.cozumelopina.mx

and received:

HTTP/1.1 200 OK

After refreshing the Vercel dashboard, www.cozumelopina.mx changed from:

Failed To Generate Cert

to:

Valid Configuration ✅

CONCLUSION

IMPORTANT:

Do not treat the CLI command as a workaround for broken DNS.

Before manually issuing the certificate, make sure the underlying DNS problem is actually resolved.

In our case, we first confirmed:

The authoritative DNS was returning the correct CNAME.
Google Public DNS (8.8.8.8) was resolving the domain correctly.
HTTP traffic was successfully reaching Vercel.
HTTP-01 validation passed using Let’s Debug.

Only after all of those checks passed did we manually trigger the certificate issuance.

The command that finally solved the stuck certificate state was:

vercel certs issue cozumelopina.mx www.cozumelopina.mx

Hope this saves someone else the time we spent troubleshooting it! 🙂