Squarespace SSL: connect a domain, allow Let's Encrypt and fix certificate errors

Squarespace secures every connected domain with a free Let's Encrypt certificate, issued and renewed automatically; you cannot upload your own. A domain registered elsewhere gets its certificate once the Squarespace DNS records are in place, which can take up to 48 hours.

If the domain overview still shows "SSL Certificates Unavailable" after 48 hours, check the DNS records, then any CAA records. Steps and screen names follow the Squarespace Help Center as of November 2026.

How Squarespace issues certificates

Squarespace requests the certificate for you as soon as the domain is connected. The Help Center says "Let's Encrypt is our certificate authority partner for providing DV (Domain-Validated) SSL certificates", and that certificates are generated for Squarespace domains, third-party domains connected to a site, subdomains and built-in domains. Squarespace uses TLS 1.2 or higher for all HTTPS connections and, as of November 2026, says its certificates refresh every 90 days.

The certificate depends on Squarespace seeing its own DNS records. Once the domain is fully connected and using Squarespace's records, a certificate is generated; Squarespace allows up to 48 hours for new and recently connected domains. When everything is fine, the domain shows the certificate as Issued in the domains dashboard and Active in the SSL panel.

Point your DNS at Squarespace

There are two ways to connect a third-party domain: nameserver connect or DNS connect. With nameserver connect you change the domain's nameservers at the registrar to Squarespace's (the Namecheap guide lists connect1.squarespacedns.com and connect2.squarespacedns.com) and DNS records are then stored at Squarespace. With DNS connect you keep your DNS host and add the records below. Start in the Domains panel, choose Use a Domain I Own, enter the domain and pick your provider.

The verification CNAME is unique to your site; copy it from the domain's DNS settings in Squarespace. If your provider cannot create it, Squarespace offers a TXT record instead. If the provider does not allow a CNAME on www, Squarespace's fallback is an A record for www pointing to 198.185.159.144. Remove old A records on @ that point elsewhere. Squarespace labels the connection Connection in progress, Connected, DNS error or Record not found while it checks the records; deprecated records left over from older setups can also block HTTPS access.

CAA records: allow letsencrypt.org

If your domain publishes CAA records, they must allow Let's Encrypt. Squarespace's troubleshooting article tells third-party domain owners to "Ask your provider if their system uses CAA record restrictions" because "Our SSL provider can't issue a certificate if there's a restriction." Squarespace's CA is Let's Encrypt, whose CAA identifier is letsencrypt.org:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

Add it next to any CAA records you already have for other services, then check the published set with the CAA checker. If the domain has no CAA records, leave it that way; no record means any CA may issue. See CAA record prevents issuance for how a CA evaluates the records.

When you see "SSL Certificates Unavailable"

Wait a full 48 hours, then check where the domain points and whether CAA restricts issuance. Squarespace's wording: "If we have trouble generating a certificate for your domain, an "SSL Certificates Unavailable" message will appear in your domain overview panel." Its troubleshooting steps, in order:

1. If the domain is new to the site, wait the full 48 hours.
2. Make sure the domain points to your Squarespace site: for Squarespace domains, the default records must be intact; for third-party domains, the records at your provider must match the table above.
3. For third-party domains, ask your provider about CAA restrictions and allow letsencrypt.org.
4. In the SSL panel, make sure the site is set to Secure.
5. After any change, wait another 48 hours and test in a private browsing window.

Squarespace adds that a certificate-processing message in domain settings is normal for up to 48 hours after connecting. If the error persists, its last-resort options are transferring the domain to Squarespace or keeping it at your provider and disabling SSL, which is rarely acceptable for a business site. Compare what resolvers see with what Squarespace expects:

dig +short A example.com
dig +short CNAME www.example.com
dig +short CAA example.com

Browser errors such as "Your connection is not private" or "Your connection is not secure" while the panel is still unavailable mean no valid certificate is served yet; see your connection is not private.

Force HTTPS: Secure, HSTS Secure or Insecure

Choose Secure in the SSL panel's security preference; that is Squarespace's preferred default and sends visitors to HTTPS. The three options are:

• Secure (Preferred): HTTPS with redirects from HTTP.
• HSTS Secure: adds HSTS, so browsers refuse plain HTTP for your domain.
• Insecure: keeps HTTP reachable even though a certificate exists. Squarespace sets domains registered or connected before October 2016 to Insecure, so older sites should check this setting.

Click Save and allow up to 48 hours for the change. Squarespace states that "It's not possible to remove SSL certificates", and warns that "Disabling HSTS or switching to the Insecure setting can temporarily prevent access to your site." Turn on HSTS Secure only after the mixed-content check below, and confirm the header with the HSTS checker.

Fix mixed content

Mixed content comes from custom code, not from Squarespace's own blocks. The Help Center notes that with the Secure setting, "visitors may find browser warnings when they load mixed content from your site." Look in Code Injection, Code Blocks, embedded widgets and any image or script URL pasted with http://, and change each to an https:// URL that works. Squarespace treats custom code as outside its support scope, so you fix it yourself.

Scan the home page and a few templates with the mixed content scanner and read mixed content warning for how browsers treat each resource type.

Can you upload your own certificate?

No. Squarespace states: "We don't support installing third-party SSL certificates." If you currently terminate HTTPS elsewhere, such as at Cloudflare, Squarespace's guidance is to switch to the Squarespace certificate. There is no plan on which an OV or EV certificate can be installed.

Verify

Once the SSL panel shows the certificate as active, the issuer should be Let's Encrypt, both names should be covered and the chain should be complete. Test the domain from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com

The SSL checker gives the same report in a browser. To check the redirect:

curl -sI http://example.com | grep -iE '^(HTTP|location)'

Renewal and shorter lifetimes

Renewal is automatic as long as the records stay in place. Let's Encrypt's default certificates move from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028, and all public certificates are capped at 200 days today, 100 days from March 15, 2027 and 47 days from March 15, 2029. Shorter lifetimes mean a DNS mistake turns into an expired certificate sooner, so re-run the checks after any DNS change and add the domain to ssl.sh monitoring (in development).