Invalid configuration

Help
,
1

Hi,

I have correctly set-up demo.inquirygrove.com and it is correctly propagated.

However I still get the Invalid Configuration bubble.

In fact, Custom domain demo.inquirygrove.com remains in “Invalid Configuration / Failed To Generate Cert”.
DNS propagation is complete, CNAME resolves correctly to the assigned vercel-dns-017.com hostname from Google Public DNS, CAA records allow Let’s Encrypt and Sectigo, but TLS handshake fails because no certificate is presented.

Can anyone please help me, as refreshing does not help?

Many thanks! :slight_smile:

2

The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points.

3

Hi Ale,

If TLS currently fails because no certificate is presented, I’d treat that as a symptom of the cert not being issued yet, not the root cause. The thing to debug is why Vercel’s certificate validation cannot complete.

For a normal non-wildcard subdomain, I’d check these from a terminal:

dig CNAME demo.inquirygrove.com +short
dig A demo.inquirygrove.com +short
dig AAAA demo.inquirygrove.com +short
dig CAA inquirygrove.com +short
dig CAA demo.inquirygrove.com +short
curl -I http://demo.inquirygrove.com/.well-known/acme-challenge/test

What I’d look for:

  • CNAME should match the exact vercel-dns-017.com target shown in the Vercel domain card.

  • There should not also be stray A or AAAA records for the same subdomain.

  • If CAA records exist, they need to allow Let’s Encrypt, since that is what Vercel uses for managed certs.

  • The HTTP challenge path should reach Vercel over plain HTTP without a proxy, redirect, WAF challenge, or cached response in front of it.

The TLS handshake failing is expected until the certificate exists, so I would not use https://demo.inquirygrove.com as the main test yet. The better signal is whether DNS and the HTTP-01 path are clean.

If all of those outputs look correct and it still stays on “Failed To Generate Cert,” the most useful follow-up would be the redacted outputs of those commands plus the exact value Vercel asks you to point the subdomain to.