NNicheStackTutorials
HugoVitePressSvelteKitAstroFrontend ToolsStatic HostingSEO & Web VitalsAd Monetization
← All tutorials
Static Hosting

Vercel SSL Certificate Stuck on Pending: DNS & CAA Fixes

Custom domain shows valid DNS but SSL never issues on Vercel. Fix CAA records, Cloudflare proxy, and apex ALIAS configuration.

·11 min read·Static Hosting
Vercel SSL Certificate Stuck on Pending: DNS & CAA Fixes cover

Domain: blog.example.com on Cloudflare DNS, site on Vercel Hobby Symptom: Vercel dashboard → Domains → SSL Certificate: Pending for 48+ hours

TL;DR

  • Disable Cloudflare orange-cloud proxy during initial SSL issuance.
  • Check CAA records allow letsencrypt.org or digicert.com.
  • Use ALIAS/ANAME for apex domains pointing to Vercel.

What Vercel expects

For subdomain blog:

Type: CNAME
Name: blog
Value: cname.vercel-dns.com

For apex example.com:

Type: A
Value: 76.76.21.21

Or use Vercel nameservers if you transfer DNS.

Mistake #1: Cloudflare orange cloud

Proxied CNAME (orange cloud) can delay or break Vercel SSL issuance.

Fix: Set DNS record to DNS only (grey cloud) until certificate shows Valid. Then optionally re-enable proxy with Full (strict).

Mistake #2: CAA record blocking Let's Encrypt

dig CAA example.com
example.com. 300 IN CAA 0 issue "letsencrypt.org"
example.com. 300 IN CAA 0 issue "digicert.com"

Vercel uses Let's Encrypt. If CAA exists but omits letsencrypt.org, issuance fails silently.

Add:

0 issue "letsencrypt.org"

Mistake #3: Old A record conflict

Had both A → 76.76.21.21 and CNAME → old-netlify.net for www. DNS returned both — Vercel couldn't verify.

Delete stale records. Only one authoritative answer per name.

Verify propagation

dig blog.example.com +short
# Should show cname.vercel-dns.com or 76.76.21.21 chain

curl -I https://blog.example.com
# HTTP/2 200 after SSL valid

Timeline after fix

Grey cloud + CAA fix → Valid certificate in ~12 minutes.

Still pending after 24h?

Check Vercel → Domains → Refresh on the certificate row. Open a ticket only if DNS is provably correct:

openssl s_client -connect blog.example.com:443 -servername blog.example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

No cert returned → DNS or proxy still wrong, not a Vercel bug.

Checklist

  1. One record per hostname
  2. Grey cloud during initial SSL
  3. CAA allows letsencrypt.org
  4. Wait 15 min before panicking

FAQ

Why is Vercel SSL stuck on Pending?

DNS not fully propagated, CAA records blocking issuance, or Cloudflare proxy intercepting validation requests.

Should I use Cloudflare proxy with Vercel?

During initial SSL setup, use DNS-only (grey cloud). After Vercel cert is active, you can enable proxy if needed.

How long does Vercel SSL usually take?

Minutes to a few hours. If pending 48+ hours, DNS or CAA misconfiguration is almost always the cause.

Tags: VercelSSLDNSCustom Domain