SSL/TLS handshake fails on custom domain despite "Valid Configuration" status

1My custom domain www.mat-profi.ru shows "Valid Configuration" in the Vercel dashboard, but the site returns an SSL/TLS error in the browser and the SSL handshake fails in curl diagnostics.23**Project:** study  4**Plan:** Hobby  5**Default domain (working):** study-sand.vercel.app ✅  6**Custom domain (broken):** www.mat-profi.ru ❌78**DNS is correct:**9

nslookup mat-profi.ru -> 216.198.79.1 ✅

12**Diagnostic result (curl):**3

Trying 216.198.79.1:443...
schannel: failed to receive handshake, SSL/TLS connection failed

12TCP connection on port 443 establishes successfully, but the TLS handshake fails. Ping to all Vercel IPs (216.198.79.1/65/129/193 and 64.29.17.1/65/129/193) works with 0% packet loss.34The domain worked fine until about 1 month ago and stopped without any changes on my side. I have tried redeploying and re-adding the domains in the dashboard multiple times.56Dashboard shows "Valid Configuration" for both mat-profi.ru (A record → 216.198.79.1) and www.mat-profi.ru (A record → 216.198.79.1).78What could prevent Vercel from completing the SSL certificate provisioning for this domain?

Same issue. Project: rentclaim, Domain: rentreclaim.xyz. Dashboard shows Valid Configuration, rentclaim.vercel.app works, but rentreclaim.xyz fails SSL handshake on Safari and WebKit. DNS: rentreclaim.xyz -> 216.198.79.1. Started recently with no changes on our side.

Hi matprofi,

Since the .vercel.app domain works and TCP reaches 216.198.79.1:443, I'd treat this as a domain/certificate provisioning path issue rather than a Next.js/deployment issue.

I'd check the certificate blockers Vercel calls out before re-adding the domain again:

1dig NS mat-profi.ru +short2dig A mat-profi.ru +short3dig A www.mat-profi.ru +short4dig CNAME www.mat-profi.ru +short5dig AAAA mat-profi.ru +short6dig AAAA www.mat-profi.ru +short7dig CAA mat-profi.ru +short8dig TXT _acme-challenge.mat-profi.ru +short9dig TXT _acme-challenge.www.mat-profi.ru +short10

A few things to look for:

NS should point to the DNS provider where you are actually editing records.
The A / CNAME results should match exactly what Vercel shows for each domain.
There should not be stale/conflicting AAAA records pointing elsewhere.
If CAA records exist, they need to allow Let's Encrypt, for example 0 issue "``letsencrypt.org``".
If old _acme-challenge TXT records exist from another host, remove them, because they can interfere with certificate issuance.

I'd also run this to confirm whether the failure is specific to the custom domain/SNI:

1openssl s_client -connect www.mat-profi.ru:443 -servername www.mat-profi.ru2

If DNS, CAA, and _acme-challenge all look clean but the handshake still fails while the Vercel dashboard says the configuration is valid, then it's probably something Vercel support/community staff would need to inspect on the certificate provisioning side.

Vercel's domain troubleshooting page has the same CAA / _acme-challenge checks here: https://vercel.com/docs/domains/troubleshooting

1My custom domain www.mat-profi.ru shows "Valid Configuration" in the Vercel dashboard, but the site returns an SSL/TLS error in the browser and the SSL handshake fails in curl diagnostics.23**Project:** study  4**Plan:** Hobby  5**Default domain (working):** study-sand.vercel.app ✅  6**Custom domain (broken):** www.mat-profi.ru ❌78**DNS is correct:**9