Renew the expired TLS certificate on Vercel
Why it matters
Browsers refuse to open a site whose certificate has expired and show visitors a full-page security warning. API clients and mobile apps fail outright, so the site is effectively down for them.
The fix
- Open the project, then Settings and Domains, and check the status of this domain. Vercel renews its certificates automatically, but only while the domain's DNS points at Vercel.
- Fix any configuration error shown, using the DNS values Vercel lists for the domain.
- If you have CAA records, they must allow letsencrypt.org, because Vercel issues with Let's Encrypt.
- Certificates you uploaded yourself (Enterprise only) are not renewed automatically and have to be replaced by hand.
- If the domain looks correctly configured and the certificate is still expired, contact Vercel support with the domain name.
Related
- Reported by the certificate chain and expiry check
- Fix a certificate that is not valid yet
- Renew the certificate before it expires
- Install a certificate that covers this hostname
- Replace the self-signed certificate with a trusted one
- Use a certificate from a publicly trusted authority
- Serve the full certificate chain
- Replace the expired intermediate certificate
- Re-issue the certificate with a stronger key
- Replace the certificate that uses a broken hash
- Fix the certificate that browsers reject
Scan your domain to see whether this applies to you.