Since our custom domain's certificate renewed in July, every iOS/Safari visitor gets an 8–25 second white screen before the site loads. Chrome is unaffected. We've isolated it fully:

Root cause: Vercel's managed certificates now issue from Let's Encrypt's Generation-Y hierarchy (leaf ← YR1/YR2 ← ISRG Root YR, cross-signed by ISRG Root X1). Apple's current trust store (version 2025082000, iOS 26 — support.apple.com/en-us/126047) includes only ISRG Root X1/X2, not Root YR. iOS trust evaluation of the unknown root stalls on every new TLS connection.

Isolation evidence (factory-reset iOS 26.5 simulator + physical iPhone):

www.intellishares.io (LE YR2 chain): 8–25 s white screen — even a single static image hangs The identical deployment on its *.vercel.app alias (Google Trust Services chain): renders in 1.1 s in the same Safari api. subdomain on a GTS chain: fast everywhere. Four origins tested; the chain is the only variable.

What we've tried: vercel certs issue re-issues — still Gen-Y. Custom cert upload is Enterprise-only (verified, API returns 402). So on Pro there is no self-service mitigation at all.

Ask: issue our domains (intellishares.io, www., preview.) from a chain current Apple devices trust — GTS (as used for vercel.app) or LE Generation-X — or ship a platform-level mitigation. This presumably affects every Pro customer with iOS traffic whose cert renewed onto Gen-Y since January 2026.

Support case: 01wPlERqr8s4IZUl (20h+, first-line confirmed no Pro-level option and escalated to engineering — hoping to speed that up).