This is a postmortem I cannot fully write, and that is the point. It happened in the early days of Hypersend, a previous product of mine, before I monitored anything. I have no logs, no screenshots, and no timeline. What I have is the memory of losing three launch days to SSL certificates, and enough scar tissue to reconstruct how.
Here is what I know for certain. It was launch week. Depending on who loaded the site, it worked, or it showed a browser security warning, or it refused to connect. Not one consistent failure. A different failure per visitor, and sometimes a different failure per refresh.
The cause, reconstructed: one domain, three certificates, and none of them agreed.
How you end up with three certificates
The first certificate came with the domain. The registrar sold it to me alongside the purchase, tied to their own infrastructure. The second belonged to an earlier deployment on a different host, which was still alive and still answering for stale DNS. The third was the one that mattered. Vercel, where the site actually lived, kept trying to issue its own certificate and kept failing, because the DNS it saw did not agree with the DNS I thought I had.
That is the part nobody warns you about. Certificates do not fail alone. They fail together with DNS. Old records pointed at the old host. New records pointed at Vercel. Resolvers around the world cached different answers for different lengths of time. So some visitors reached the old host and got its old certificate. Some reached the registrar's parking page and got theirs. Some reached Vercel, which could not yet prove it owned the domain, so they got an error. Every one of those visitors saw my launch as broken. Each in a slightly different way.
And because caches expire on their own schedule, every fix looked like it worked and then did not. I would change a record, test it, see it work, announce it fixed, and then someone in a different country would send a screenshot of a security warning. For three days.
The cleanup
The fix was manual archaeology. Find every DNS record still pointing at the old host and delete it. Kill the registrar's certificate product so it stopped answering for the domain. Remove the old deployment entirely. Then re-add the domain in Vercel and wait, doing nothing, while caches drained, because there was nothing left to do but wait.
Three days of a launch window, spent on a problem that produced no error in any log I owned. Nothing was down, by any definition my tooling had. Every individual system was working as configured. The configuration itself was the outage.
What I actually needed
What I needed that week was one boring page that answered three questions. Which certificate are visitors actually being served, right now, from where I am not standing? Who issued it, and for which exact hostnames? And is anything, like a stale DNS record or a CAA entry, blocking the certificate that should exist from being issued?
No page like that existed for me, so years later I built it. CertPost checks the certificate your users actually receive, validates the whole chain and hostname list, and watches the DNS records underneath it for drift. The instant check is free, no signup, because the week I needed it, I would not have signed up for anything. I just needed to see what the world saw.
If you are launching something this month: check your certificate from outside your own machine, once, today. It takes ten seconds and it is the cheapest insurance you will ever get.