Skip to content

SSL status

Every custom domain gets an HTTPS certificate automatically, issued free of charge by Let's Encrypt and renewed by our servers. There is nothing to buy or up...

Every custom domain gets an HTTPS certificate automatically, issued free of charge by Let's Encrypt and renewed by our servers. There is nothing to buy or upload.

  • Not yet issued: the domain is Verified but nobody has visited it over HTTPS yet. Open https://go.yourbrand.com in a browser; the certificate is issued during that first visit, usually within a minute (the very first page load may take a few seconds).
  • Valid: certificate active; renewed automatically about 30 days before expiry.
  • Failed: issuance blocked. Common causes and fixes:
  • Proxied record: on Cloudflare the record is orange-cloud (proxied), so the certificate authority reaches Cloudflare's servers instead of ours and cannot confirm the domain. Switch the record to DNS only (grey cloud) and click Retry.
  • CAA record: your domain has a CAA record that does not allow Let's Encrypt. Add 0 issue "letsencrypt.org" (or remove the restriction) and click Retry. Check with dig yourbrand.com CAA.
  • Record removed or wrong: the CNAME or A record no longer points to us. Fix it and click Check DNS.
  • Rate limit: Let's Encrypt limits how many certificates a domain can receive per week. Repeated retries make it worse; wait an hour and retry once.

Certificates are stored on our servers and cannot be downloaded. Visitors who type http:// are redirected to https:// automatically. As with every HTTPS certificate, the domain name is recorded in public certificate transparency logs.