Webflow SSL: connect a custom domain, allow the right CAs and fix errors

Webflow issues and renews SSL certificates for every custom domain automatically, from Let's Encrypt or Google Trust Services, once the domain's DNS points at Webflow; SSL cannot be turned off. Most certificate problems come from leftover DNS records, a missing _webflow TXT record, CAA records that leave out one of the two CAs, or a Cloudflare proxy.

Steps and screen names follow the Webflow Help Center as of November 2026.

How Webflow issues certificates

Webflow requests the certificate once it can see your records. The Help Center says "Webflow provisions SSL certificates through two certificate authorities": Let's Encrypt and Google Trust Services (via Cloudflare, which runs Webflow's hosting edge). It also states: "Your site's DNS records must point to Webflow before we can issue an SSL certificate", and once they do, issuance typically happens within a few minutes. DNS changes can take up to 48 hours to propagate in all locations.

Renewal is automatic while DNS keeps pointing to Webflow. Either CA can issue the next certificate, which is why CAA records must allow both.

Point your DNS at Webflow

Connect the domain manually with three records, after removing the old ones. Before connecting, Webflow asks you to delete all A records on the root and all CNAMEs on the hosts you are connecting. Then add, at your DNS host:

Webflow also publishes an optional AAAA record for the root, @ → 2620:cb:2000::1, if you want IPv6. Keep your DNS host's default nameservers; Webflow does not use its own nameservers for custom domains.

Older sites may still point at legacy records. Webflow states: "As of January 13, 2026, you can't publish to a custom domain that points to Webflow's legacy DNS records." If your www CNAME still targets proxy-ssl.webflow.com, change it to cdn.webflow.com and replace old root A records with 198.202.211.1.

Cloudflare in front of Webflow

On standard hosting, set the Webflow records to DNS only (grey cloud). Webflow's Cloudflare guide explains that a "525 Handshake Error" means the Cloudflare proxy (orange cloud) may be enabled on those records. If you need the proxy, Webflow documents an Orange-to-Orange (O2O) setup with proxied CNAMEs to cdn.webflow.com; in that mode domain verification looks broken in Webflow, and the Help Center says "This is expected, as the proxy hides your DNS records from Webflow's verification check." One more Cloudflare trap: "Cloudflare blocks Webflow from issuing SSL certificates for held zones", so release a Zone Hold until the certificate is issued.

CAA records: allow both CAs

If you publish CAA records, Webflow needs two of them. Its CAA article lists these values:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"
example.com.  3600  IN  CAA  0 issue "pki.goog; cansignhttpexchanges=yes"

Webflow's explanation: "If a CA isn't listed in your CAA records, it won't be allowed to issue a certificate for your site", and without these records SSL certificates for your site may fail to provision or renew. Allowing only letsencrypt.org can work for months and then fail when the renewal is routed to Google Trust Services. Verify with the CAA checker and see CAA record prevents issuance.

When the domain shows an error or SSL does not arrive

Start in Site settings → Publishing → Production, where each domain shows its status and a Check status button. Labels you will meet there include Update needed (shown when a domain still uses outdated records), Issues detected, Verify domain and, once the TXT record is found, Custom domain verified. Webflow does not publish a separate "SSL pending" status; a domain that is verified and pointed gets its certificate within minutes.

Webflow's article "Why does my domain show an error status?" lists four causes, quoted by name:

• "Incorrect nameservers": the domain is not using its DNS host's default nameservers, so your records are not served.
• "DNS propagation issues": changes have not reached all resolvers yet; wait up to 48 hours.
• "Incorrect DNS records": the A, CNAME or TXT values do not match the table above.
• "Additional DNS records": extra A, AAAA or CNAME records on the same host conflict with Webflow's.

Fix the records, click Check status under each domain, then publish the site again. Compare with what public DNS returns:

dig +short A example.com
dig +short CNAME www.example.com
dig +short TXT _webflow.example.com
dig +short CAA example.com

HTTPS and HSTS

HTTPS is always on: the Help Center states "You cannot disable SSL on Webflow sites." To make every hostname land on one canonical address, set a default domain in Site settings → Publishing → Production → Make default; Webflow redirects the other connected domains to it.

HSTS settings are in Site settings → Publishing → Advanced publishing options, with options to enable HSTS, include subdomains and send the preload header. Webflow's security-headers article adds that "HSTS response headers are enabled automatically for all non-Enterprise sites and cannot be disabled." Before including subdomains or preloading, make sure every subdomain, including ones hosted elsewhere, serves valid HTTPS; check the result with the HSTS checker and read enable HSTS.

Fix mixed content

Mixed content on Webflow means your site's code contains HTTP URLs. Webflow's troubleshooting article tells you to find them in the browser console and replace them with the HTTPS version, if it exists. Check custom code in site and page settings, Embed elements, link fields, social icons, video fields and CMS link fields, which often hold http:// URLs imported from an old site.

The mixed content scanner lists every insecure resource on a published page; mixed content warning explains which ones browsers block outright.

Can you upload your own certificate?

Only on Enterprise: "Custom SSL certificate uploads are only available for Enterprise customers." The upload is in Site settings → Publishing → Custom SSL certificates → Add certificate. Webflow expects an RSA certificate chain in PEM format and an unencrypted PKCS#8 private key, uploaded once per domain, including www, and you renew it yourself. Public certificates have been capped at 200 days since March 15, 2026 and drop to 100 days on March 15, 2027 and 47 days on March 15, 2029, so a custom certificate becomes a recurring manual job. Use the CSR generator and SSL converter if you need a PKCS#8 key.

Verify

After publishing, both hostnames should show Let's Encrypt or Google Trust Services as the issuer (or your CA on Enterprise), with both names covered and the chain complete. Test them from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com

The SSL checker shows the same in a browser. Webflow does not renew far in advance, so add the domain to ssl.sh monitoring (in development) if you want an outside alert when a renewal stalls.