Netlify custom domain HTTPS setup and troubleshooting

Netlify provisions a free Let's Encrypt certificate for every custom domain you add, as soon as the domain's DNS points at Netlify, and renews Netlify-managed certificates automatically. With external DNS you point the apex at Netlify's load balancer and www at your netlify.app name. Domains on Netlify DNS also get an automatic wildcard certificate.

Steps and screen names follow Netlify's documentation as of November 2026. The site name brave-curie-12345.netlify.app and the domain example.com are examples.

At a glance

Step 1: Add the domain and choose a primary domain

Add the custom domain to the site under Domain management. Netlify treats extra names such as www.example.com as domain aliases, and every alias is included in the certificate when it is issued. DNS must already be correct for each alias, otherwise it is left off.

With external DNS, Netlify recommends making a subdomain the primary domain. Apex domains resolve to the load balancer, so they cannot use direct DNS routing on Netlify's CDN; www.example.com can.

Step 2: Create the DNS records

Netlify needs one apex record and a www CNAME at your external DNS provider:

Keep one apex record only. Netlify's troubleshooting page warns that extra apex A records and leftover AAAA records break certificate provisioning, because the load balancer does not support IPv6. If you move the domain to Netlify DNS instead, make sure the registrar uses Netlify's name servers, and turn off DNSSEC first; Netlify DNS does not support it.

Query public DNS to confirm the records:

dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com CNAME

The AAAA query should return nothing.

Step 3: Check CAA records

Existing CAA records must allow Let's Encrypt, or provisioning fails. With no CAA record, any CA may issue. To allow only Netlify's Let's Encrypt account, Netlify documents a record with its accounturi:

example.com.  300  IN  CAA  0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714"

A plain 0 issue "letsencrypt.org" also works but lets any Let's Encrypt account issue. If you use other CAs elsewhere on the domain, add them as separate issue records. Generate and test records with the CAA generator and CAA checker.

Wildcards and custom certificates

Netlify issues a wildcard certificate automatically when the domain uses Netlify DNS, which gives instant HTTPS to every Netlify site on a subdomain of that domain. Netlify also warns that more than 5 aliases on subdomains of the same domain can hit its CA's rate limits; in that case bring your own wildcard certificate or ask support before adding the aliases.

To install your own certificate, open Domain management > HTTPS and select Set Custom Certificate. You need:

• the certificate in X.509 PEM format,
• the unencrypted private key,
• the intermediate chain from your CA.

Netlify checks that the certificate matches the site's domain and that DNS points at Netlify. A wildcard or multi-name certificate installed on one site applies to all your sites it covers. Custom certificates are never renewed automatically: renew at your CA and install the new files, or switch back to a Netlify-managed certificate.

Verify

Both example.com and www.example.com should appear in the certificate's Subject Alternative Name list, with Let's Encrypt as the issuer. Check it from outside with the SSL checker, or in a terminal:

curl ssl.sh/example.com

Then inspect the certificate the server sends:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject -ext subjectAltName -dates

The status is also visible in Domain management > HTTPS.

Automatic renewal

Netlify-managed certificates are generated and renewed automatically as needed. Renewal only keeps working while DNS still points at Netlify and CAA still allows Let's Encrypt. Let's Encrypt no longer sends expiry emails (they ended on June 4, 2025), and its default lifetime drops to 64 days on February 10, 2027 and 45 days on February 16, 2028, so add custom certificates and important domains to ssl.sh monitoring (in development).

Troubleshooting

Most Netlify certificate errors come from DNS records, DNSSEC or CAA. Netlify's troubleshooting page lists these messages:

• We could not provision a Let's Encrypt certificate for your custom domain: check the apex A/ALIAS record, the www CNAME, AAAA records, DNSSEC and CAA, then provision again.
• Waiting on DNS propagation (stuck more than 48 hours): Netlify needs fully propagated, correct records. Old records cached elsewhere must expire first; compare results from several resolvers.
• DNS verification failed: the records point somewhere else or a proxy is in front. Disable proxying such as Cloudflare's orange cloud, because Netlify must terminate TLS itself.
• Missing certificate, or nothing happens after clicking Provision certificate: usually the same DNS problems; run Let's Debug against the domain.
• Your domain doesn't appear to be served by Netlify: the domain resolves to another host. Fix the records listed above.
• Certificate provisioning has been pending for over 24 hours: Netlify retries every 10 minutes for the first 24 hours and then hourly for two days. No certificate after 24 hours almost always means a DNS mistake.
• HTTPS not working or showing "connection not secure" warnings: Netlify sometimes gets a certificate for one name (say example.com) but not another (www.example.com or an alias). Selecting Renew certificate should fix it; if not, support can repair the certificate. See also NET::ERR_CERT_COMMON_NAME_INVALID.
• example.com is not resolvable with a resolver that validates DNSSEC: DNSSEC is still enabled at the registrar or previous DNS host while you use Netlify DNS. Disable it there (DNSViz shows where it is enabled), or keep DNSSEC and use external DNS instead.

For CAA-specific errors read CAA record prevents issuance. If nothing helps, contact Netlify support with the site name, your DNS setup (external or Netlify DNS) and what you tried.