Out of the box, every Deployment on Vercel is served over an HTTPS connection. The SSL certificates for these unique URLs are automatically generated free of charge.
Furthermore, any HTTP requests to your Deployments are automatically forwarded to HTTPS using the 308
status code:
HTTP/1.1 308 Moved Permanently Content-Type: text/plain Location: https://<your-deployment-host>
It is not possible to disable this redirection or prevent the Deployment from being served over HTTPS as it is considered an industry standard to serve web content over a secure connection.
Supported TLS Versions
Vercel supports TLS version 1.2 and TLS version 1.3.
TLS Resumption
Vercel supports both Session Identifiers and Session Tickets as methods for resuming a TLS connection. This can significantly improve Time To First Byte for second time visitors.
OCSP Stapling
To ensure clients can validate TLS certificates as quickly as possible, we staple an OCSP response allowing them to skip a network request to check for revocation.
Supported Ciphers
In order to ensure the integrity of the data received and sent by any Deployment running on the Vercel platform, we only support strong ciphers with forward secrecy.
The following cipher algorithms are supported:
- TLS_AES_128_GCM_SHA256 (TLS 1.3)
- TLS_AES_256_GCM_SHA384 (TLS 1.3)
- TLS_CHACHA20_POLY1305_SHA256 (TLS 1.3)
- ECDHE-ECDSA-AES128-GCM-SHA256 (TLS 1.2)
- ECDHE-RSA-AES128-GCM-SHA256 (TLS 1.2)
- ECDHE-ECDSA-AES256-GCM-SHA384 (TLS 1.2)
- ECDHE-RSA-AES256-GCM-SHA384 (TLS 1.2)
- ECDHE-ECDSA-CHACHA20-POLY1305 (TLS 1.2)
- ECDHE-RSA-CHACHA20-POLY1305 (TLS 1.2)
- DHE-RSA-AES128-GCM-SHA256 (TLS 1.2)
- DHE-RSA-AES256-GCM-SHA384 (TLS 1.2)
This is the recommended configuration from Mozilla.
Support for HSTS
The .vercel.app
domain (and therefore all of its sub domains, which are the unique URLs set when creating a deployment) support HSTS automatically and are preloaded.
Strict-Transport-Security: max-age=63072000; includeSubDomains; preload;
Custom domains use HSTS, but only for the particular subdomain.
Strict-Transport-Security: max-age=63072000;
You can modify this by setting the Strict-Transport-Security
(more details) header in your deployment.
Theoretically, you could set the max-age
parameter to a different value (it indicates how long the client should remember that your site is only accessible over HTTPS), but since we do not allow connections made over HTTP, there is no point in setting it to a shorter value, as the client can just remember it forever.
How Certificates Are Handled
The unique URLs generated when creating a deployment are handled using a wildcard certificate issued for the .vercel.app
domain. The Vercel platform generates wildcard certificates using LetsEncrypt and keeps them updated automatically.
When custom certificates are generated using vercel certs issue
, however, their keys are placed in our database and encrypted at rest within the Network layer.
Then, once a hostname is requested, the certificate and key are read from the database and used for establishing the secure connection. In addition, both are cached in memory for optimal SSL termination performance.
Full Specification
Any features of the encryption mechanism that were left uncovered are documented here. You only need to make sure to select any IP address of your choice (it does not matter which one you pick – the results are the same for all).