Custom domain SSL cert never provisions, TLS handshake fails on every edge IP (Hobby plan)

Project: ivan-portfolio

Plan: Hobby

Issue duration: 3+ days

My project's custom domain has never successfully served HTTPS since I added it. Browser shows ERR_SSL_PROTOCOL_ERROR. The Domains tab shows "Valid Configuration" with a green checkmark, but that doesn't reflect reality.

What I've confirmed, ruling out DNS/network/local causes:

DNS resolves correctly everywhere: local resolver, Google's 8.8.8.8, and a full root -> TLD -> ns2.vercel-dns.com trace. DNSSEC chain is intact.
- Ping succeeds with 0% packet loss to all 8 of the domain's edge IPs.
- - The TLS handshake fails identically on every single one of those 8 IPs:
  - error:1404B42E:SSL routines:ST_CONNECT:tlsv1 alert protocol version
  - Connection gets closed before any certificate is ever presented.
  - - Reproduced this from 3+ different networks/computers, so it's not local caching, ISP routing, or one machine's config.
    - - Ran Vercel's own official diagnostic script (vercel-support/vercel-connect-debug on GitHub) and it shows the same failure.
      - The project's default *.vercel.app URL loads fine over HTTPS with no issues, so this is isolated to the custom domain's certificate specifically.
        
        Already tried removing and re-adding the domain from the project (the usual fix for a stuck cert). Waited 20+ minutes after. Same exact error, no change.
        
        Emailed support and got an auto-reply that email isn't a valid support channel for Hobby plan, and a follow-up from the AI agent in vercel.com/help suggesting it was a local network issue, which the evidence above rules out.
        
        This looks like a genuine certificate provisioning failure on Vercel's edge for this domain specifically. Has anyone else hit this, or is there something else I should try? Happy to share the exact domain and full debug output with a Vercel team member directly if that helps investigate.
      - Also worth noting: this matches two other unresolved reports of the same failure mode on this forum (Vercel edge TLS handshake dying on every IP for a Hobby-plan custom domain, despite DNS/network being confirmed fine and the official debug script showing the same result). One never got a real fix and the poster ended up migrating off Vercel entirely; the other is still open with no reply. This looks like a recurring platform-level bug rather than an isolated case.