Description

Ensure every domain on the team's projects has a valid SSL certificate that has not expired and is renewing automatically. Vercel issues and renews certificates for domains that are configured correctly, so any domain with a missing or failing certificate should be investigated and fixed.

Rationale

Without a valid SSL certificate, browsers show security warnings or block the site, and traffic may not be encrypted. This causes outages, damages user trust, and can expose data. Certificate problems are usually caused by wrong DNS records or missing CAA records, which stop Vercel from issuing or renewing the certificate.

Impact

  • Visitors connect securely without browser warnings

  • Prevents outages caused by expired certificates

  • Requires correct DNS and CAA records

Default Value

By default, Vercel automatically issues and renews SSL certificates for correctly configured domains.

Pre-Requisites

  • Team Owner or Member role

  • Vercel CLI installed and signed in

  • Access to the domain's DNS provider

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar and select Domains.

  5. Check that each domain shows no certificate errors.

  6. Run vercel certs ls to list the team's certificates and check their expiry dates.

  7. If a certificate is missing, failing, or close to expiry without renewal, follow the implementation steps.

Implementation Steps

  1. Fix the domain's DNS records so they point to Vercel.

  2. If the domain has CAA records, add one that allows letsencrypt.org.

  3. Run vercel certs issue <domain> to request a new certificate.

  4. Run vercel certs ls again and confirm the new expiry date.

Backout Plan

  1. Restore the previous DNS or CAA records at your DNS provider.

  2. If a new certificate was issued by mistake, remove it with vercel certs rm <certificate-id>.

Reference