# Netlify custom domain HTTPS: DNS, CAA and certificate errors

> Set up HTTPS for a Netlify custom domain: the 75.2.60.5 and CNAME records, Let's Encrypt CAA values, wildcards, custom certificates and error fixes.

Source: https://ssl.sh/guides/netlify-custom-domain-https/
Last updated: 2026-11-10

Netlify provisions a free Let's Encrypt certificate for every custom domain you add, as soon as the domain's DNS points at Netlify, and renews Netlify-managed certificates automatically. With external DNS you point the apex at Netlify's load balancer and `www` at your `netlify.app` name. Domains on Netlify DNS also get an automatic wildcard certificate.

Steps and screen names follow Netlify's documentation as of November 2026. The site name `brave-curie-12345.netlify.app` and the domain `example.com` are examples.

## At a glance

| Question | Netlify |
|---|---|
| CA for automatic certificates | Let's Encrypt |
| Apex (`example.com`) | ALIAS/ANAME/flattened CNAME to `apex-loadbalancer.netlify.com`, or `A` to `75.2.60.5` |
| `www` and other subdomains | `CNAME` to `brave-curie-12345.netlify.app` |
| CAA must allow | Let's Encrypt (`letsencrypt.org`) |
| Wildcard certificates | Automatic when the domain uses Netlify DNS |
| Upload your own certificate | Yes, **Set Custom Certificate**; no plan restriction stated in the docs |
| Renewal | Automatic for Netlify-managed certificates, manual for custom ones |

## Step 1: Add the domain and choose a primary domain

Add the custom domain to the site under **Domain management**. Netlify treats extra names such as `www.example.com` as domain aliases, and every alias is included in the certificate when it is issued. DNS must already be correct for each alias, otherwise it is left off.

With external DNS, Netlify recommends making a subdomain the primary domain. Apex domains resolve to the load balancer, so they cannot use direct DNS routing on Netlify's CDN; `www.example.com` can.

## Step 2: Create the DNS records

Netlify needs one apex record and a `www` CNAME at your external DNS provider:

| Type | Name | Value |
|---|---|---|
| `ALIAS`, `ANAME` or flattened `CNAME` | `@` | `apex-loadbalancer.netlify.com` |
| `A` (fallback if none of the above) | `@` | `75.2.60.5` |
| `CNAME` | `www` | `brave-curie-12345.netlify.app` |

Keep one apex record only. Netlify's troubleshooting page warns that extra apex `A` records and leftover `AAAA` records break certificate provisioning, because the load balancer does not support IPv6. If you move the domain to Netlify DNS instead, make sure the registrar uses Netlify's name servers, and turn off DNSSEC first; Netlify DNS does not support it.

Query public DNS to confirm the records:

```bash
dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com CNAME
```

The `AAAA` query should return nothing.

## Step 3: Check CAA records

Existing CAA records must allow Let's Encrypt, or provisioning fails. With no CAA record, any CA may issue. To allow only Netlify's Let's Encrypt account, Netlify documents a record with its `accounturi`:

```dns
example.com.  300  IN  CAA  0 issue "letsencrypt.org;accounturi=https://acme-v02.api.letsencrypt.org/acme/acct/54403714"
```

A plain `0 issue "letsencrypt.org"` also works but lets any Let's Encrypt account issue. If you use other CAs elsewhere on the domain, add them as separate `issue` records. Generate and test records with the [CAA generator](https://ssl.sh/tools/caa-generator/) and [CAA checker](https://ssl.sh/tools/caa-checker/).

## Wildcards and custom certificates

Netlify issues a wildcard certificate automatically when the domain uses Netlify DNS, which gives instant HTTPS to every Netlify site on a subdomain of that domain. Netlify also warns that more than 5 aliases on subdomains of the same domain can hit its CA's rate limits; in that case bring your own wildcard certificate or ask support before adding the aliases.

To install your own certificate, open **Domain management > HTTPS** and select **Set Custom Certificate**. You need:

- the certificate in X.509 PEM format,
- the unencrypted private key,
- the intermediate chain from your CA.

Netlify checks that the certificate matches the site's domain and that DNS points at Netlify. A wildcard or multi-name certificate installed on one site applies to all your sites it covers. Custom certificates are never renewed automatically: renew at your CA and install the new files, or switch back to a Netlify-managed certificate.

## Verify

Both `example.com` and `www.example.com` should appear in the certificate's Subject Alternative Name list, with Let's Encrypt as the issuer. Check it from outside with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or in a terminal:

```bash
curl ssl.sh/example.com
```

Then inspect the certificate the server sends:

```bash
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -subject -ext subjectAltName -dates
```

The status is also visible in **Domain management > HTTPS**.

## Automatic renewal

Netlify-managed certificates are generated and renewed automatically as needed. Renewal only keeps working while DNS still points at Netlify and CAA still allows Let's Encrypt. Let's Encrypt no longer sends expiry emails (they ended on June 4, 2025), and its default lifetime drops to 64 days on February 10, 2027 and 45 days on February 16, 2028, so add custom certificates and important domains to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).

## Troubleshooting

Most Netlify certificate errors come from DNS records, DNSSEC or CAA. Netlify's troubleshooting page lists these messages:

- **We could not provision a Let's Encrypt certificate for your custom domain**: check the apex A/ALIAS record, the `www` CNAME, AAAA records, DNSSEC and CAA, then provision again.
- **Waiting on DNS propagation** (stuck more than 48 hours): Netlify needs fully propagated, correct records. Old records cached elsewhere must expire first; compare results from several resolvers.
- **DNS verification failed**: the records point somewhere else or a proxy is in front. Disable proxying such as Cloudflare's orange cloud, because Netlify must terminate TLS itself.
- **Missing certificate**, or nothing happens after clicking **Provision certificate**: usually the same DNS problems; run Let's Debug against the domain.
- **Your domain doesn't appear to be served by Netlify**: the domain resolves to another host. Fix the records listed above.
- **Certificate provisioning has been pending for over 24 hours**: Netlify retries every 10 minutes for the first 24 hours and then hourly for two days. No certificate after 24 hours almost always means a DNS mistake.
- **HTTPS not working or showing "connection not secure" warnings**: Netlify sometimes gets a certificate for one name (say `example.com`) but not another (`www.example.com` or an alias). Selecting **Renew certificate** should fix it; if not, support can repair the certificate. See also [NET::ERR_CERT_COMMON_NAME_INVALID](https://ssl.sh/errors/net-err-cert-common-name-invalid/).
- **example.com is not resolvable with a resolver that validates DNSSEC**: DNSSEC is still enabled at the registrar or previous DNS host while you use Netlify DNS. Disable it there (DNSViz shows where it is enabled), or keep DNSSEC and use external DNS instead.

For CAA-specific errors read [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). If nothing helps, contact Netlify support with the site name, your DNS setup (external or Netlify DNS) and what you tried.