SSL/TLS handshake fails on custom domain despite "Valid Configuration" status

Help
1 
My custom domain www.mat-profi.ru shows "Valid Configuration" in the Vercel dashboard, but the site returns an SSL/TLS error in the browser and the SSL handshake fails in curl diagnostics.

**Project:** study  
**Plan:** Hobby  
**Default domain (working):** study-sand.vercel.app ✅  
**Custom domain (broken):** www.mat-profi.ru ❌

**DNS is correct:**

nslookup mat-profi.ru → 216.198.79.1 :white_check_mark:


**Diagnostic result (curl):**

  • Trying 216.198.79.1:443…

  • schannel: failed to receive handshake, SSL/TLS connection failed


TCP connection on port 443 establishes successfully, but the TLS handshake fails. Ping to all Vercel IPs (216.198.79.1/65/129/193 and 64.29.17.1/65/129/193) works with 0% packet loss.

The domain worked fine until about 1 month ago and stopped without any changes on my side. I have tried redeploying and re-adding the domains in the dashboard multiple times.

Dashboard shows "Valid Configuration" for both mat-profi.ru (A record → 216.198.79.1) and www.mat-profi.ru (A record → 216.198.79.1).

What could prevent Vercel from completing the SSL certificate provisioning for this domain?
2

Same issue. Project: rentclaim, Domain: rentreclaim.xyz. Dashboard shows Valid Configuration, rentclaim.vercel.app works, but rentreclaim.xyz fails SSL handshake on Safari and WebKit. DNS: rentreclaim.xyz → 216.198.79.1. Started recently with no changes on our side.

3

Hi matprofi,

Since the .vercel.app domain works and TCP reaches 216.198.79.1:443, I’d treat this as a domain/certificate provisioning path issue rather than a Next.js/deployment issue.

I’d check the certificate blockers Vercel calls out before re-adding the domain again:

dig NS mat-profi.ru +short
dig A mat-profi.ru +short
dig A www.mat-profi.ru +short
dig CNAME www.mat-profi.ru +short
dig AAAA mat-profi.ru +short
dig AAAA www.mat-profi.ru +short
dig CAA mat-profi.ru +short
dig TXT _acme-challenge.mat-profi.ru +short
dig TXT _acme-challenge.www.mat-profi.ru +short

A few things to look for:

  • NS should point to the DNS provider where you are actually editing records.

  • The A / CNAME results should match exactly what Vercel shows for each domain.

  • There should not be stale/conflicting AAAA records pointing elsewhere.

  • If CAA records exist, they need to allow Let’s Encrypt, for example 0 issue "``letsencrypt.org``".

  • If old _acme-challenge TXT records exist from another host, remove them, because they can interfere with certificate issuance.

I’d also run this to confirm whether the failure is specific to the custom domain/SNI:

openssl s_client -connect www.mat-profi.ru:443 -servername www.mat-profi.ru

If DNS, CAA, and _acme-challenge all look clean but the handshake still fails while the Vercel dashboard says the configuration is valid, then it’s probably something Vercel support/community staff would need to inspect on the certificate provisioning side.

Vercel’s domain troubleshooting page has the same CAA / _acme-challenge checks here:
https://vercel.com/docs/domains/troubleshooting