[▲ Vercel Community](/) · [Categories](/categories) · [Latest](/latest) · [Top](/top) · [Live](/live) [Help](/c/help/9) # SSL certificate not issued for subdomain despite correct DNS configuration - invalid 20 views · 0 likes · 3 posts Jerrian 4021 (@jerrian-4021) · 2026-02-05 ## Problem SSL certificate is not being issued for my subdomain `winkel.ehgn.nl`, even though DNS is correctly configured. HTTP works, but shows a page without CSS. HTTPS fails with SSL handshake error. ## Setup - **Domain:** [winkel.ehgn.nl](https://winkel.ehgn.nl) (subdomain) and or [shop.ehgn.nl](https://shop.ehgn.nl) - **Root domain ([ehgn.nl](https://ehgn.nl)):** Hosted elsewhere (not on Vercel) - **Project:** Astro SSR app, deploys successfully to [ehgn-shop.vercel.app](https://ehgn-shop.vercel.app) ## DNS Configuration - **Record type:** CNAME - **Name:** winkel - **Value:** [cname.vercel-dns.com](https://cname.vercel-dns.com) - **Nameservers:** Third-party ([redecohosting.net](https://redecohosting.net)) ## Verification Done 1. DNS resolves correctly: dig [winkel.ehgn.nl](https://winkel.ehgn.nl) CNAME +short → [cname.vercel-dns.com](https://cname.vercel-dns.com). 2. CAA records allow Let's Encrypt: dig [ehgn.nl](https://ehgn.nl) CAA +short → 0 issue "[letsencrypt.org](https://letsencrypt.org)" 3. HTTP works (200 OK from Vercel): curl -I http://winkel.ehgn.nl → HTTP/1.1 200 OK → Server: Vercel 4. HTTPS fails: curl -I https://winkel.ehgn.nl → SSL_ERROR_SYSCALL ## What I've Tried - Removed and re-added domain in Vercel dashboard - Tried A record (76.76.21.21) instead of CNAME - Tried the CNAME value that Vercel gave me (new one, b5XXXXXXcname.) - Waited 24+ hours for certificate issuance - Ran `vercel certs issue winkel.ehgn.nl` → "Error: Response Error" - Ran `vercel alias set` → "Error: Response Error" ## Vercel Dashboard Status - Domain shows "Invalid Configuration" - SSL Certificates section shows "No certificates to show" - DNS records section shows the domain pointing to correct IP ## Environment - Vercel CLI: 50.4.8 - Project type: Astro SSR with @astrojs/vercel adapter ## Question Why is the SSL certificate not being issued? The DNS is correct, CAA allows Let's Encrypt, and HTTP traffic already reaches Vercel. What's blocking the certificate generation? How can I fix it? For any subdomain white the root is hosted elsewhere. system (@system) · 2026-02-05 The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for [bonus points](https://community.vercel.com/t/introducing-the-vercel-leaderboard/1358). https://vercel.com/docs/projects/domains/troubleshooting You can also use [v0](https://v0.dev/) to narrow down the possibilities. Pauline P. Narvas (@pawlean) · 2026-02-05 In case it's helpful, from our docs: https://vercel.com/docs/domains/troubleshooting#common-ssl-certificate-issues I recommend going through this guide as well: https://vercel.com/kb/guide/domain-not-generating-ssl-certificate [quote="Jerrian 4021, post:1, topic:32864, username:jerrian-4021"] but shows a page without CSS. [/quote] I had a quick look, and it looks like your CSS file isn't being called *at all.* Can you review that in your code? Feel free to ask [v0.app](https://v0.app) for pointers directly connected to your codebase :slight_smile: