SSL certificate not working on your custom domain?
Why HTTPS fails after you connect your own domain to Vercel or Netlify: DNS, leftover AAAA records, CAA rules, proxies and mixed content, with the fix for each.
Leer en español →
When the SSL certificate won't work on your custom domain, the host usually can't prove to Let's Encrypt that the domain points to it. The cause is almost always in DNS: a record still pointing somewhere else, an old AAAA record, a CAA record that blocks Let's Encrypt, or a proxy in front of the host. Fix that, and Vercel or Netlify issue the certificate on their own.
This guide helps you tell which problem you have from the browser warning, check each cause in order, and confirm the fix. It also covers the "Not secure" warning that has nothing to do with the certificate at all.
What does the browser warning tell you?
Different symptoms point to different causes, so start here.
| What you see | What it usually means |
|---|---|
"Your connection is not private" with NET::ERR_CERT_COMMON_NAME_INVALID | The certificate served is for another name: an old host, or www isn't covered |
ERR_SSL_PROTOCOL_ERROR | No valid certificate on that hostname yet, or something on the network is interfering |
| The page loads but the address bar says "Not secure" | Mixed content: the page is HTTPS but loads images or scripts over http:// |
| Your host's domain page shows an error or "Invalid Configuration" | DNS doesn't match what the host expects, so it can't issue the certificate |
| Netlify says "We could not provision a Let's Encrypt certificate for your custom domain" | Validation failed; Netlify keeps retrying while you fix DNS |
Compare with the generated address (yourapp.vercel.app or yoursite.netlify.app). If that works over HTTPS and your domain doesn't, the problem is between your domain and the host, not in your code.
How do Vercel and Netlify issue the certificate?
Both use Let's Encrypt and both do it for free. For a normal domain, Let's Encrypt asks for a small file at /.well-known/acme-challenge/ on your domain over plain HTTP, and the host answers it. That only works if the domain's DNS sends the request to the host. Wildcard domains are different: they need a DNS-based check, which is why Vercel asks you to use its nameservers or delegate the _acme-challenge name for them.
Renewals use the same check, so a setup that blocks validation can also break a certificate that worked before.
How do I fix it, step by step?
1. Make sure both names are added to the project
Add both yourdomain.com and www.yourdomain.com in the host's domain settings, and choose which one redirects to the other. A certificate only covers the names you added. If visitors type www and only the root was added, they get a name mismatch.
2. Check what DNS actually returns
dig a yourdomain.com +short
dig aaaa yourdomain.com +short
dig cname www.yourdomain.com +shortThe root should return only the A value your host shows (Netlify documents 75.2.60.5; Vercel shows the value in your project's domain settings). www should return the CNAME your host gave you. Any extra A record for the root, such as the registrar's parking page, has to go. Netlify's troubleshooting docs specifically warn that extra apex A records cause failures.
3. Remove AAAA records that point elsewhere
This one catches many people. If your domain still has an AAAA (IPv6) record from the registrar's default setup, Let's Encrypt prefers the IPv6 address and tries it first. It only falls back to IPv4 on a connection timeout, not on other errors, so a stale AAAA record can make validation fail even when your A record is perfect. Neither Vercel nor Netlify supports IPv6 for custom domains today, so delete AAAA records on names that point to them.
4. Check for a CAA record that blocks Let's Encrypt
dig caa yourdomain.com +noall +answerNo CAA records is fine; it means any authority may issue. If there is a CAA record and it doesn't include Let's Encrypt, add one:
yourdomain.com. CAA 0 issue "letsencrypt.org"For wildcard certificates, an issuewild record must allow it too. CAA policies are inherited from the parent domain, so check the root even if you are setting up a subdomain.
5. Take proxies out of the path
If your DNS is on Cloudflare with the proxy on (orange cloud), the challenge request may never reach your host. Vercel's domain troubleshooting guide says to set the record to DNS only, or route /.well-known/acme-challenge/* to Vercel without caching, redirects or authentication. The same applies to any other proxy or firewall in front of the site.
6. Wait, then retry
DNS changes take time to spread, depending on the old record's TTL. Netlify retries every 10 minutes for the first 24 hours, then hourly for two more days. If nothing appears after 24 hours, its docs say a DNS misconfiguration is the likely cause, so go back to step 2. Let's Debug, which Vercel recommends, runs the same checks Let's Encrypt does and names the problem in plain terms.
Why does the browser still say "Not secure"?
If the certificate is valid (click the padlock icon area and look at the certificate details) but the page still shows a warning, the page is loading something over plain HTTP. Common culprits in AI-built apps:
- An image or logo URL saved in the database as
http://… - A hard-coded API base URL in an environment variable that starts with
http:// - An embedded widget or font loaded from an old address
Open the browser console; mixed content warnings name each URL. Change them to https:// or to relative paths, redeploy, and reload.
How do I confirm the fix worked?
- The host's domain page shows the domain as valid with a certificate.
https://yourdomain.comandhttps://www.yourdomain.comboth load without warnings, and one redirects to the other.- Test from another network, for example a phone on mobile data, to rule out a local cache.
- Log in and log out on the custom domain. If login sends you back to the preview URL, your auth settings still point to the old address; our guide on Lovable login redirecting to localhost shows the fix.
Quick answers
How long does certificate issuance take? Usually minutes once DNS is right. If it's been more than a day, DNS is almost certainly still wrong.
Do I need to buy an SSL certificate? No. Vercel and Netlify issue and renew Let's Encrypt certificates for free. Uploading your own certificate is limited to specific plans on Vercel.
Can I keep Cloudflare's proxy on? Sometimes, but it adds a layer that must pass validation and renewals through. If you don't need the proxy's features, DNS only is simpler.
Why did HTTPS work before and break now? Renewal failed. Something changed since issuance: a new CAA record, a proxy, or DNS moved elsewhere.
Still stuck on HTTPS?
If you've been through these steps and the certificate still won't issue, our maintenance and support team handles domain and certificate problems as part of keeping apps running. See our DNS records explainer for background, run the free health check, or contact us with your domain name.
