# Shopify SSL certificate: DNS, CAA, SSL pending and HTTPS fixes > How Shopify issues free SSL certificates for custom domains, which DNS and CAA records it needs, and how to fix SSL pending or SSL unavailable. Source: https://ssl.sh/guides/shopify-ssl-certificate/ Last updated: 2026-11-10 Shopify gives every domain you add to a store a free TLS (SSL) certificate and renews it for you; there is nothing to buy or install, and you cannot upload your own. For a domain registered elsewhere, the certificate appears once the A, AAAA and CNAME records point at Shopify, which can take up to 48 hours. If the admin still says "SSL pending" or "SSL unavailable" after that, the cause is almost always a DNS record, a CAA record or DNSSEC. Steps and screen names follow the Shopify Help Center as of November 2026. ## How Shopify issues certificates Shopify provisions certificates on its own; your only job is DNS. The Help Center says a certificate is issued automatically for the store's `.myshopify.com` address, for domains bought or transferred through Shopify, and for third-party domains you connect, and that TLS certificates are free for all domains added to Shopify. Every domain and subdomain you add, such as `example.com`, `www.example.com` or a second storefront domain, is covered once it points at Shopify. Shopify does not say which single certificate authority signs a given certificate. Its CAA guidance lists three: [Let's Encrypt](https://ssl.sh/cas/lets-encrypt/), [Google Trust Services](https://ssl.sh/cas/google-trust-services/) (`pki.goog`) and [SSL.com](https://ssl.sh/cas/ssl-com/). The issuer you see in a certificate check can be any of them and may change at renewal, which is why CAA records must allow all three. When the domain is connected and secured, the Domains page shows it as **Connected**. ## Point your DNS at Shopify Connect the domain in the admin, then set the records the Help Center lists. Go to **Settings → Domains → Connect existing domain**. Shopify can connect domains automatically for some providers (the Help Center names Cloudflare, GoDaddy and IONOS); for any other DNS host, add these records by hand: | Type | Name | Value | |---|---|---| | A | `@` | `23.227.38.65` | | AAAA | `@` | `2620:0127:f00f:5::` | | CNAME | `www` | `shops.myshopify.com` | Delete every other A and AAAA record on the root so that only one of each remains, and do not leave a wildcard record pointing at Shopify. Some DNS panels reject the short IPv6 form; Shopify gives `2620:0127:f00f:0005:0000:0000:0000:0000` as the expanded equivalent. Keep your registrar's default nameservers or your current DNS host; a third-party domain is connected with records, not by delegating it to Shopify. If your DNS is on Cloudflare, set the Shopify records to **DNS only** (grey cloud). Shopify's Cloudflare article states that "Cloudflare proxy setups, including Orange-to-Orange, aren't supported", and a proxied record hides the real target from Shopify's checks. ## CAA records: allow all three CAs You do not need [CAA](https://ssl.sh/glossary/caa/) records for Shopify, but any you have must allow every CA Shopify uses. The Help Center says "You don't need CAA records for your store." If you keep CAA records, for example because another service on the domain uses them, publish all three values: ```text example.com. 3600 IN CAA 0 issue "letsencrypt.org" example.com. 3600 IN CAA 0 issue "pki.goog; cansignhttpexchanges=yes" example.com. 3600 IN CAA 0 issue "ssl.com" ``` Shopify also warns about two traps. A CAA record whose value is only a semicolon forbids every CA, and parameters such as `accounturi` or `validationmethods` can block Shopify's issuance even when the CA name is listed. Check the published records with the [CAA checker](https://ssl.sh/tools/caa-checker/), and read [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/) for how the check works. ## When the certificate stays "SSL pending" or "SSL unavailable" Wait 48 hours, then check DNS, CAA and DNSSEC in that order. These are the labels the Help Center uses for the domain in **Settings → Domains**: - **"SSL pending"** (also written "TLS pending"): Shopify is waiting for DNS to propagate and the certificate to be issued. - **"SSL unavailable"**: Shopify cannot provision a certificate for the domain. - **"Your connection is unsecure"**: what shoppers see on the storefront when no valid certificate is in place. When Shopify can tell what is wrong, it shows a notification. The Help Center quotes these: - "Your domain doesn't permit Google, Let's Encrypt and SSL.com to provision SSL certificates." Add the three CAA values above. - "Your domain's CAA record blocks SSL certificate provisioning." Remove the semicolon-only or restrictive record, or extend it. - "A DNSSEC misconfiguration is blocking access to your DNS records." Turn DNSSEC off at the domain provider and recheck the Domains page; the change can take up to 48 hours. - "Your domain has an unsupported DNSSEC record." This applies to Shopify-managed domains transferred in with DNSSEC; Shopify Support has to remove it. If no notification explains it, follow Shopify's checklist: confirm the A record is `23.227.38.65`, check the AAAA and CNAME values, confirm the CAA records, deactivate DNSSEC, and contact Shopify Support if the domain is still pending after 48 hours. Query public DNS to see what Shopify sees: ```bash dig +short A example.com dig +short AAAA example.com dig +short CNAME www.example.com dig +short CAA example.com ``` When only a few customers report a security warning while everyone else sees the padlock, Shopify's troubleshooting list points at outdated clients: Android 7.0 or lower and browsers older than 2010. ## HTTPS is forced automatically There is no HTTPS switch to turn on. Shopify redirects visitors from the unencrypted address to the encrypted storefront by itself. [HSTS](https://ssl.sh/glossary/hsts/) is handled too: the Help Center says HSTS is always active on a domain while it is connected to your store, and the policy remains in effect for another 90 days after the domain is removed. Before moving the domain, make sure the new host serves working HTTPS. Do not stack extra redirect rules at a DNS provider or proxy in front of Shopify; they only add hops or loops. ## Fix mixed content A page counts as insecure if any asset on it is not loaded over HTTPS. Shopify puts it plainly: "Any page in your Shopify online store that includes an asset that isn't delivered over HTTPS is considered to be insecure." Typical culprits are hard-coded `http://` URLs in theme code, custom Liquid sections, page content and third-party app snippets, plus fonts and images hosted on other servers. Shopify's advice is to host your store's assets on Shopify so they inherit HTTPS; anything that must stay elsewhere needs a working `https://` URL. Run the home page, a product page and the cart through the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/), replace each `http://` reference it reports, and see [mixed content warning](https://ssl.sh/errors/mixed-content-warning/) for how browsers block or flag each resource type. ## Can you upload your own certificate? No. The Help Center states: "You can't use third-party SSL certificates with your Shopify store." It gives no plan-level exception, so an OV or EV certificate bought elsewhere cannot be used on the storefront. If another system on the same domain needs a paid certificate (an API on a subdomain hosted elsewhere, say), install it there and keep your CAA records broad enough to allow both that CA and Shopify's three. ## Verify Once the Domains page shows the domain as connected, both hostnames should present a certificate from one of Shopify's three CAs, with matching names, a complete chain and a future expiry date. Check them from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the same report in a browser. Confirm the redirect as well: ```bash curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` ## Renewal and shorter certificate lifetimes Shopify renews certificates without any action from you, as long as DNS keeps pointing at Shopify and CAA keeps allowing its CAs. Lifetimes are shrinking across the industry: public TLS certificates have been capped at 200 days since March 15, 2026, and the cap drops to 100 days on March 15, 2027 and 47 days on March 15, 2029 (see the [certificate validity timeline](https://ssl.sh/timeline/certificate-validity/)). More frequent renewals mean a broken DNS record or a new CAA record surfaces faster, so recheck the store after any DNS change and add it to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) for an outside view.