TLS certificate not issued for playground subdomain — server presents default cluster certificate (C
⚙️Deno CLI
Hello Deno Deploy team,
I'm having an issue with TLS certificate issuance for my playground subdomains and would appreciate your help.
What happens:
I deployed a playground project bigmodel-relay on <2026-09-07 at 19:04:35>, and later a second one zai-relay (<2026-09-07 at 23:06:31>). Free tier, region: all (ord, ams).
The application itself works fine: with certificate verification disabled (curl -k), requests to https://zai-relay.alexluksha.deno.net/ return the expected response — so SNI-based HTTP routing reaches my deployment correctly.
However, TLS verification fails on all clients (curl 8.x / schannel, Chrome, .NET): the server presents the default cluster certificate with Subject CN=ams.vultr.prod.deno-cluster.net (Issuer: Let's Encrypt; valid 2026-08-19 … 2026-11-17) instead of a certificate covering *.alexluksha.deno.net.
curl reports: (60) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL.
Even the dashboard's built-in Preview shows a certificate warning.
For comparison: the account root domain alexluksha.deno.net serves a valid certificate (handshake succeeds, HTTP 404 — expected, since nothing is deployed there).
What I've already tried:
Waited 12+ hours since the first deployment — no change.
Created a second playground under a different name — identical behavior.
Checked the playground Settings — there is no "Domains" section there (only the org-level "Domains" page, which is empty), so I see no way to trigger re-issuance myself.
Questions:
Is this a known issue with per-subdomain certificate issuance?
Could you please check/provision certificates for zai-relay.alexluksha.deno.net and bigmodel-relay.alexluksha.deno.net?
Is there any way on my side to force certificate re-issuance?
Account: alexluksha (<alexluksha@gmail.com>)
Thank you very much for your time!
I'm having an issue with TLS certificate issuance for my playground subdomains and would appreciate your help.
What happens:
I deployed a playground project bigmodel-relay on <2026-09-07 at 19:04:35>, and later a second one zai-relay (<2026-09-07 at 23:06:31>). Free tier, region: all (ord, ams).
The application itself works fine: with certificate verification disabled (curl -k), requests to https://zai-relay.alexluksha.deno.net/ return the expected response — so SNI-based HTTP routing reaches my deployment correctly.
However, TLS verification fails on all clients (curl 8.x / schannel, Chrome, .NET): the server presents the default cluster certificate with Subject CN=ams.vultr.prod.deno-cluster.net (Issuer: Let's Encrypt; valid 2026-08-19 … 2026-11-17) instead of a certificate covering *.alexluksha.deno.net.
curl reports: (60) schannel: SNI or certificate check failed: SEC_E_WRONG_PRINCIPAL.
Even the dashboard's built-in Preview shows a certificate warning.
For comparison: the account root domain alexluksha.deno.net serves a valid certificate (handshake succeeds, HTTP 404 — expected, since nothing is deployed there).
What I've already tried:
Waited 12+ hours since the first deployment — no change.
Created a second playground under a different name — identical behavior.
Checked the playground Settings — there is no "Domains" section there (only the org-level "Domains" page, which is empty), so I see no way to trigger re-issuance myself.
Questions:
Is this a known issue with per-subdomain certificate issuance?
Could you please check/provision certificates for zai-relay.alexluksha.deno.net and bigmodel-relay.alexluksha.deno.net?
Is there any way on my side to force certificate re-issuance?
Account: alexluksha (<alexluksha@gmail.com>)
Thank you very much for your time!
