# Squarespace SSL: DNS, CAA and SSL Certificates Unavailable > How Squarespace issues free Let's Encrypt SSL, the DNS and CAA records a domain needs, and how to fix SSL Certificates Unavailable. Source: https://ssl.sh/guides/squarespace-ssl/ Last updated: 2026-11-10 Squarespace secures every connected domain with a free Let's Encrypt certificate, issued and renewed automatically; you cannot upload your own. A domain registered elsewhere gets its certificate once the Squarespace DNS records are in place, which can take up to 48 hours. If the domain overview still shows "SSL Certificates Unavailable" after 48 hours, check the DNS records, then any CAA records. Steps and screen names follow the Squarespace Help Center as of November 2026. ## How Squarespace issues certificates Squarespace requests the certificate for you as soon as the domain is connected. The Help Center says "Let's Encrypt is our certificate authority partner for providing DV (Domain-Validated) SSL certificates", and that certificates are generated for Squarespace domains, third-party domains connected to a site, subdomains and built-in domains. Squarespace uses TLS 1.2 or higher for all HTTPS connections and, as of November 2026, says its certificates refresh every 90 days. The certificate depends on Squarespace seeing its own DNS records. Once the domain is fully connected and using Squarespace's records, a certificate is generated; Squarespace allows up to 48 hours for new and recently connected domains. When everything is fine, the domain shows the certificate as **Issued** in the domains dashboard and **Active** in the SSL panel. ## Point your DNS at Squarespace There are two ways to connect a third-party domain: nameserver connect or DNS connect. With **nameserver connect** you change the domain's nameservers at the registrar to Squarespace's (the Namecheap guide lists `connect1.squarespacedns.com` and `connect2.squarespacedns.com`) and DNS records are then stored at Squarespace. With **DNS connect** you keep your DNS host and add the records below. Start in the **Domains** panel, choose **Use a Domain I Own**, enter the domain and pick your provider. | Type | Host | Value | |---|---|---| | CNAME | the unique code shown in Squarespace (starts with `v`) | `verify.squarespace.com` | | CNAME | `www` | `ext-cust.squarespace.com` | | A | `@` | `198.185.159.144` | | A | `@` | `198.185.159.145` | | A | `@` | `198.49.23.144` | | A | `@` | `198.49.23.145` | The verification CNAME is unique to your site; copy it from the domain's DNS settings in Squarespace. If your provider cannot create it, Squarespace offers a TXT record instead. If the provider does not allow a CNAME on `www`, Squarespace's fallback is an A record for `www` pointing to `198.185.159.144`. Remove old A records on `@` that point elsewhere. Squarespace labels the connection **Connection in progress**, **Connected**, **DNS error** or **Record not found** while it checks the records; deprecated records left over from older setups can also block HTTPS access. ## CAA records: allow letsencrypt.org If your domain publishes [CAA](https://ssl.sh/glossary/caa/) records, they must allow Let's Encrypt. Squarespace's troubleshooting article tells third-party domain owners to "Ask your provider if their system uses CAA record restrictions" because "Our SSL provider can't issue a certificate if there's a restriction." Squarespace's CA is Let's Encrypt, whose CAA identifier is `letsencrypt.org`: ```text example.com. 3600 IN CAA 0 issue "letsencrypt.org" ``` Add it next to any CAA records you already have for other services, then check the published set with the [CAA checker](https://ssl.sh/tools/caa-checker/). If the domain has no CAA records, leave it that way; no record means any CA may issue. See [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/) for how a CA evaluates the records. ## When you see "SSL Certificates Unavailable" Wait a full 48 hours, then check where the domain points and whether CAA restricts issuance. Squarespace's wording: "If we have trouble generating a certificate for your domain, an "SSL Certificates Unavailable" message will appear in your domain overview panel." Its troubleshooting steps, in order: 1. If the domain is new to the site, wait the full 48 hours. 2. Make sure the domain points to your Squarespace site: for Squarespace domains, the default records must be intact; for third-party domains, the records at your provider must match the table above. 3. For third-party domains, ask your provider about CAA restrictions and allow `letsencrypt.org`. 4. In the SSL panel, make sure the site is set to **Secure**. 5. After any change, wait another 48 hours and test in a private browsing window. Squarespace adds that a certificate-processing message in domain settings is normal for up to 48 hours after connecting. If the error persists, its last-resort options are transferring the domain to Squarespace or keeping it at your provider and disabling SSL, which is rarely acceptable for a business site. Compare what resolvers see with what Squarespace expects: ```bash dig +short A example.com dig +short CNAME www.example.com dig +short CAA example.com ``` Browser errors such as "Your connection is not private" or "Your connection is not secure" while the panel is still unavailable mean no valid certificate is served yet; see [your connection is not private](https://ssl.sh/errors/your-connection-is-not-private/). ## Force HTTPS: Secure, HSTS Secure or Insecure Choose **Secure** in the SSL panel's security preference; that is Squarespace's preferred default and sends visitors to HTTPS. The three options are: - **Secure (Preferred)**: HTTPS with redirects from HTTP. - **HSTS Secure**: adds [HSTS](https://ssl.sh/glossary/hsts/), so browsers refuse plain HTTP for your domain. - **Insecure**: keeps HTTP reachable even though a certificate exists. Squarespace sets domains registered or connected before October 2016 to Insecure, so older sites should check this setting. Click **Save** and allow up to 48 hours for the change. Squarespace states that "It's not possible to remove SSL certificates", and warns that "Disabling HSTS or switching to the Insecure setting can temporarily prevent access to your site." Turn on HSTS Secure only after the mixed-content check below, and confirm the header with the [HSTS checker](https://ssl.sh/tools/hsts-checker/). ## Fix mixed content Mixed content comes from custom code, not from Squarespace's own blocks. The Help Center notes that with the Secure setting, "visitors may find browser warnings when they load mixed content from your site." Look in Code Injection, Code Blocks, embedded widgets and any image or script URL pasted with `http://`, and change each to an `https://` URL that works. Squarespace treats custom code as outside its support scope, so you fix it yourself. Scan the home page and a few templates with the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) and read [mixed content warning](https://ssl.sh/errors/mixed-content-warning/) for how browsers treat each resource type. ## Can you upload your own certificate? No. Squarespace states: "We don't support installing third-party SSL certificates." If you currently terminate HTTPS elsewhere, such as at Cloudflare, Squarespace's guidance is to switch to the Squarespace certificate. There is no plan on which an OV or EV certificate can be installed. ## Verify Once the SSL panel shows the certificate as active, the issuer should be Let's Encrypt, both names should be covered and the chain should be complete. Test the domain from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) gives the same report in a browser. To check the redirect: ```bash curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` ## Renewal and shorter lifetimes Renewal is automatic as long as the records stay in place. Let's Encrypt's default certificates move from 90 to 64 days on February 10, 2027 and to 45 days on February 16, 2028, and all public certificates are capped at 200 days today, 100 days from March 15, 2027 and 47 days from March 15, 2029. Shorter lifetimes mean a DNS mistake turns into an expired certificate sooner, so re-run the checks after any DNS change and add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).