Laravel Vapor custom domain SSL

Laravel vapor ssl certificate errors mean API Gateway, CloudFront, or the regional load balancer in front of your Lambda is presenting an expired or mismatched leaf—not an Artisan configuration bug.

Vapor maps vanity domains through AWS-managed infrastructure. Certificate state lives in ACM and Vapor’s domain records, while your Laravel env vars only affect application URLs after TLS succeeds.

Start every ticket with external openssl on the custom domain Vapor shows as Valid in the dashboard.

First response

Capture the Vapor Domain name, environment (production, staging), and AWS region shown in the Vapor UI. Export the domain status badge and any validation error text.

From your laptop, save openssl notAfter, issuer, and subject for https://api.yourbrand.com (replace with the failing host). If you use the Vapor CLI, run vapor domain:list and vapor domain:describe DOMAIN for validation CNAME targets—paste both CLI JSON and openssl into the incident channel.

Do not rotate APP_URL until TLS is healthy; misconfigured URLs mask handshake failures in logs. Note whether the domain uses Vapor’s managed certificate or an imported ACM ARN from another account.

Export API Gateway stage names attached to the custom domain; mislinked stages present default execute-api certs unrelated to your marketing hostname. If the project uses multiple Vapor environments sharing vanity DNS, confirm which environment owns the domain in the dashboard to avoid renewing the wrong stack.

What this error means

Clients negotiate TLS with AWS edge components Vapor provisions when you attach a custom domain to an environment. ACM certificates must be Issued and attached to the API Gateway custom domain name (and CloudFront distribution when used). An expired imported cert, a deleted validation record, or a domain stuck in Pending validation yields browser date errors or endless “provisioning” states.

PKIX validation is unchanged: if the served leaf’s notAfter passed, mobile apps and browsers refuse the connection before API Gateway invokes Lambda. Laravel vapor ssl certificate troubleshooting is therefore AWS DNS + certificate inventory, then Vapor’s deploy hook—not PHP opcode caches.

Hostname coverage must include every SAN customers hit: apex, www, and regional aliases added in Vapor’s domain list.

Common causes

ACM auto-renewal fails when the CNAME AWS published for DNS validation disappears from the authoritative zone—common after marketing teams migrate DNS to a new registrar without copying _acme-challenge style validation records.

Teams import a commercial cert into ACM manually and forget annual reimport; Vapor continues routing traffic to the stale ARN. Cross-account ACM shares break when the resource policy is revoked.

Cloudflare or another proxy terminates TLS with its own cert while origin to API Gateway is misconfigured; external users see one chain, origin health checks another. Route 53 alias targets pointed at retired CloudFront distribution IDs serve old distributions with expired certs.

Vapor environment deletion/recreate without re-adding domains leaves DNS CNAMEs aiming at deleted API Gateway custom domain names. Staging domains copied to production without separate validation never finish issuance.

Teams running Laravel Octane on Vapor still depend on the same API Gateway custom domain bindings—PHP runtime settings never bypass ACM. When laravel vapor ssl certificate appears after an AWS Organizations SCP change, verify ACM and API Gateway API permissions in the member account still allow RequestCertificate and CreateDomainName. Rate limits after rapid domain add/remove cycles can delay issuance up to a day; avoid thrashing DNS during that window.

Confirm from the outside

echo | openssl s_client -connect api.yourbrand.com:443 -servername api.yourbrand.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

Trace redirects—Vapor may force apex:

curl -vI --connect-timeout 15 https://api.yourbrand.com/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|subject:|issuer:|location:'

CLI on a machine with Vapor credentials:

vapor domain:list
vapor domain:describe api.yourbrand.com

In AWS Console (if you have access): Certificate Manager in the same region Vapor documents for custom domains, filter Issued vs Expired, open the cert matching your domain and confirm In use by lists API Gateway or CloudFront.

Browser spot-check

Mobile apps using certificate pinning are rare with Vapor APIs but common in partner SDKs—ask integrators for literal TLS error strings. Safari’s ATS may block subdomains missing from SAN even when apex works; openssl each failing host separately.

How to read the output

notAfter in the past confirms user-facing expiry. If openssl shows Amazon-issued RSA cert with fresh dates but browsers fail only on www, you likely need a separate domain entry in Vapor. Pending validation in vapor domain:describe means fix DNS before blaming Lambda cold starts.

Fix checklist

Work this list in order for Laravel Vapor custom domain SSL. Each step should produce artifacts—CLI output, ACM ARN, openssl serial—that the next responder can verify without repeating destructive DNS edits.

1. Vapor UI → Domains → select host → note validation records; republish missing CNAME/TXT at your DNS host.
2. Wait for ACM status Issued (can take up to an hour after DNS propagates).
3. If using imported certs, upload renewed PEM + chain to ACM and update the ARN Vapor references.
4. vapor deploy production only after domain shows valid—deploy refreshes mappings.
5. Remove conflicting A records that bypass Vapor endpoints when docs require CNAME to *.vapor-farm-*.com style targets.
6. Re-run external openssl; confirm serial change.
7. Smoke-test authenticated API routes and Sanctum cookie domains over HTTPS.
8. Document which AWS account owns ACM for audit.

Roll out and verify

Coordinate Vapor deploys with ACM state: a green vapor deploy while ACM still shows Pending validation wastes team attention on Lambda cold starts. Use AWS Health Dashboard and ACM event history if institutional access exists; attach ARN screenshots to the change record.

Validate regional behavior when customers use geo DNS—some Route 53 latency records may send APAC traffic through a distribution still mapped to an older cert. Test mobile carriers and corporate proxies that intercept TLS; they surface laravel vapor ssl certificate errors before your browser does.

After recovery, run contract tests against live API routes with certificate pinning disabled (most clients do not pin). Update runbooks so the next engineer knows which AWS account, region, and Vapor environment owns each vanity domain.

When to use automation

Vapor’s dashboard is per-domain, not per-portfolio. Schedule external TLS checks on every API and app hostname after each vapor domain:* change and before major releases. ACM renewal depends on stable DNS—monitor registration expiry via RDAP on the same labels.

A one-shot live certificate check validates what API Gateway presents globally. Ongoing ssldays monitoring adds 30/14/7/1-day reminders without logging into AWS weekly.

CloudWatch alarms on custom domain 5xx rates lag certificate expiry—clients fail before your application logs show errors. Tag each vanity domain in your internal service catalog with Vapor environment id so auditors know which ACM account to inspect. Pair TLS monitoring with synthetic JWT login flows hitting the same hostname mobile apps use.

See load balancer presenting an expired certificate when Vapor sits behind an additional corporate ALB, and curl SSL certificate expired for scripting checks in CI.

Laravel Vapor teams should maintain a living diagram that lists each vanity domain, its Vapor environment id, AWS account id, ACM region, and the CNAME customers publish. During acquisitions, orphaned domains stay in Route 53 while ACM expires in a sandbox account nobody can log into. Executive escalations need the public hostname and current notAfter, not screenshots from a VPN-split laptop that resolves internal split-horizon DNS.

When Sanctum SPA authentication fails alongside TLS errors, fix certificates before rotating SESSION_DOMAIN or cookie SameSite attributes. Mobile apps distributed through enterprise MDM may cache TLS failures separately from browsers—ask field testers for literal error strings. Penetration testers sometimes report expired subdomains omitted from the last Vapor domain audit; export the domain list quarterly and openssl each label even if marketing retired the microsite.

Triage myths for laravel vapor ssl certificate tickets: flushing local DNS does not renew ACM; Lambda concurrency limits do not cause PKIX date errors; pinning the issue on “Vapor outage” without openssl proof wastes hours. Valid closure requires the same hostname that failed at open to show future notAfter from an external network path.

Post incident reviews for Laravel Vapor should name the DNS owner, the AWS account owner, and the Vapor team owner in one confluence page. Handoffs between agencies routinely leave validation CNAMEs in a former vendor Route 53 zone while production traffic moved elsewhere. Certificate transparency logs help prove whether a new leaf was ever published globally, which settles arguments about caching versus true non issuance.

Legal and compliance teams may ask for proof that customer data in transit was protected during the outage window. Document when TLS failed and when external verification showed a renewed publicly trusted chain. That timeline is separate from application deploy timestamps in GitHub Actions. Schedule the next validation review before the ninety day ACM boundary, not on the day of expiry.

Partners integrating with your API should receive a short status note when vanity domain TLS is restored, because their retries may remain cached until they restart workers. FinOps teams comparing Vapor invoices to traffic drops during expiry should align graphs with openssl timestamps rather than Lambda invocation counts alone. Treat missing DNS validation records as configuration debt that compounds each time engineering reorganizes cloud accounts. Internal wiki pages should link Vapor domain names to on call rotation aliases so holiday coverage does not wait on a single senior engineer who alone knows the AWS root login. Board reporting on application availability should exclude days when customers could not complete TLS handshakes on production API hostnames.