Vercel SSL certificate provisioning delays

Vercel ssl certificate expired or stuck on “Provisioning” means the edge has not attached a valid Let’s Encrypt chain for your production domain—visitors may see date errors or endless pending states.

Vercel manages TLS for projects on *.vercel.app automatically. Custom apex and subdomains require DNS verification in Settings → Domains.

Do not redeploy Next.js or tweak middleware.ts until openssl shows whether the problem is certificate lifecycle or routing.

First response

Open Project → Settings → Domains, note each domain’s status (Valid, Pending, Invalid Configuration, Expired). Copy recommended DNS records (A/AAAA/CNAME) and any conflict warnings.

Run openssl on the failing host and on project-name.vercel.app. If using wildcard or team-level domains, check Teams → Domains for duplicate claims.

List recent changes: transferred DNS to Cloudflare, enabled proxy orange cloud, added CAA issuewild restrictions, or attached the domain to another Vercel project in a personal account.

For monorepos, verify each Vercel project’s domain list—developers sometimes add api. to the wrong Git branch project. Vercel ssl certificate expired on preview URLs is separate from production; nevertheless, stakeholders may share preview links in email and confuse the scope.

What this error means

Vercel’s Anycast edge requests certificates after you add a domain to a project and DNS points at Vercel. Renewal depends on ongoing DNS control and HTTP/DNS-01 style validation internal to their pipeline.

When provisioning stalls, the edge may serve no cert, an old expired cert from a previous attachment, or a default cert that does not include your SAN—browsers report vercel ssl certificate expired even if your last deployment succeeded.

Serverless functions and Edge Config are unrelated; TLS completes before a request reaches your function region.

Common causes

CNAME flattening at apex to non-Vercel IPs leaves part of traffic on an expired legacy server.

Domain added to staging project while production DNS still references an old team’s certificate set. CAA records only allow a commercial CA Vercel does not use for automatic issuance.

Cloudflare proxy in front of Vercel without proper SSL mode causes double termination confusion—openssl may show Cloudflare’s cert while Vercel dashboard shows pending origin.

Expedited DNS TTL cuts without waiting for negative cache clear. Removing and re-adding domain rapidly hits rate limits on certificate authority side.

Using *.vercel.app URLs in production marketing while custom domain expired confuses support—customers hit the broken vanity host.

Edge middleware that rewrites host headers does not renew certificates—only DNS ownership in the Vercel project does. Turborepo teams deploying dozens of microsites from one account should export a domain inventory quarterly; forgotten microsite certs expire without anyone receiving deploy emails.

Confirm from the outside

echo | openssl s_client -connect www.yourapp.com:443 -servername www.yourapp.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

curl -vI --connect-timeout 15 https://www.yourapp.com/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|server:|\* '

DNS sanity:

dig +short www.yourapp.com CNAME
dig +short yourapp.com A

Vercel CLI:

vercel domains ls
vercel domains inspect www.yourapp.com

How to read the output

Past notAfter with Let’s Encrypt or R3 issuer often means renewal failed—fix DNS then trigger re-issue from dashboard. Connection timeout to wrong IP means DNS mispointing, not Vercel delay. Valid dates on *.vercel.app but not custom domain isolates configuration on that label.

Browser spot-check

Next.js Image optimization requests go through the same hostname—broken TLS blocks hero images even when API routes pass synthetic monitors using IP literals (which you should not rely on).

Fix checklist

Work this list in order for Vercel ssl certificate expired provisioning or renewal delays. Capture vercel domains inspect JSON before and after DNS fixes.

1. Domains tab → follow Invalid Configuration wizard; apply exact record set.
2. Remove domain from unused Vercel projects/teams.
3. Temporarily disable CAA or add provider-permitted issuance per Vercel docs.
4. If using Cloudflare, set SSL to Full or Full (strict) and consider DNS-only during initial issue.
5. Use Refresh / re-add domain after DNS propagates globally.
6. Wait for status Valid (often 15–60 minutes); avoid parallel manual cert uploads unless on Enterprise custom cert flow.
7. Re-run openssl; verify HSTS headers if you enabled Strict-Transport-Security in vercel.json.
8. Test API routes and auth callbacks on the custom domain.

Roll out and verify

Vercel projects with ISR and edge caching can serve stale headers after TLS fixes—issue a harmless redeploy or purge CDN cache tags if your plan supports it. Hit /_next/data/ routes and server actions on the custom domain; they share the same certificate as static assets.

Document which Vercel team owns billing; domains stuck on a departed employee’s hobby team cause repeat vercel ssl certificate expired cycles. Align VERCEL_URL and environment variables only after openssl passes.

Run Lighthouse or WebPageTest from an external vantage point to confirm HSTS preload headers still make sense now that dates are valid.

When to use automation

Vercel deployment webhooks do not alert on notAfter. Monitor each production custom domain with external TLS checks after DNS or team migrations.

Use /check when status flips to Valid and on a weekly cadence for critical APIs. ssldays complements Vercel email with 30/14/7/1-day thresholds.

Preview deployments and production share monitoring responsibility—stakeholders circulate *.vercel.app links that also expire independently. Monitor Server Actions and OAuth callback routes. Document CAA records in infrastructure-as-code so security audits do not accidentally block the next issuance.

See Netlify SSL certificate expired and DigitalOcean App Platform SSL issues for sibling platform comparisons.

Monorepo organizations often attach production domains to preview projects during hackathons—clean up DNS attachments or certificates stall in limbo. Security teams enabling CAA records without Vercel’s issuance CAs block provisioning that worked last quarter. Edge Config and Middleware rewrites do not influence certificate renewal; stubborn tickets should return to DNS ownership proof.

Compliance audits asking for “TLS inventory” should export Vercel domain lists per team and store openssl transcripts monthly. Serverless functions calling legacy partner APIs may still succeed while user-facing domains fail—do not close incidents based on background job health alone.

Vercel ssl certificate expired incidents stay open until vercel domains inspect reports Valid and openssl shows fresh notAfter on the same label. Teams that only watch deployment logs miss DNS regressions until expiry. Document which teammate owns the Vercel team billing login—domains stranded on ex-employee accounts repeat every quarter without a central domain inventory.

Engineering managers should treat custom domain TLS on Vercel as infrastructure owned by the platform team, not as a frontend concern that resolves itself after merge. Onboarding checklists for new hires must include where domains live in the Vercel UI and which DNS host is authoritative. Acquisition integration projects should map every hostname in Route fifty three or Cloudflare to a still active Vercel project before decommissioning legacy servers.

Customer trust incidents during provisioning delays need status page communication that distinguishes certificate issuance from application bugs. Support macros blaming deploy frequency confuse stakeholders when DNS validation never completed. Schedule a calendar reminder sixty days before commercial certificate imports expire on enterprise plans that bypass automatic issuance.

SRE teams running synthetic uptime beside Vercel should disable certificate ignoring in probes; otherwise green dashboards coexist with customer TLS failures. Teach product managers that a successful preview URL demo does not transfer to the production custom domain without DNS validation in the production project. Investor demos scheduled on custom domains should have a fallback netlify or default Vercel hostname ready only for emergencies, but marketing must not confuse that fallback with the contracted branded URL customers expect. Procurement teams evaluating Vercel enterprise should ask how custom domain TLS is monitored across regions, not only how quickly serverless functions deploy. Beta programs inviting users to custom domains should gate invites on confirmed valid TLS, not merely on successful feature flags in the Vercel dashboard. Hackathon winners pointing demo domains at Vercel should document which teammate account owns DNS before the team disperses. Venture backed startups rotating interns through Vercel access should export domain ownership each quarter to avoid orphaned validation records. Compliance questionnaires asking about TLS on customer facing APIs deserve answers backed by recent independent handshake checks. Platform engineers should add custom domain TLS status to weekly engineering dashboards beside error rate and latency. Red weekly TLS rows should block feature launches on affected hostnames.