How to Set Up a Custom Domain and Free SSL Certificate on Netlify

Adding a custom domain to a Netlify site takes about five minutes. Getting the free SSL certificate to provision cleanly is where most people lose an afternoon. The good news: Netlify issues Let’s Encrypt certificates automatically for every custom domain, and when it fails, the cause is almost always a DNS problem you can spot in under a minute. More at https://projectai.in.

This guide walks through the full Netlify custom domain SSL setup, both with Netlify DNS and with an external registrar, then digs into the troubleshooting side: why provisioning fails, what the error messages actually mean, and how to force a renewal when a certificate gets stuck.

What You Get With Netlify SSL (and What It Costs)

Netlify provisions a free Let’s Encrypt certificate for every site, including custom domains, on all plans (Free included). There is no manual CSR, no key upload, no annual renewal task. hamatti.org goes into the numbers.

• Automatic issuance once your DNS points at Netlify
• Automatic renewal before the 90-day Let’s Encrypt expiry
• Multi-domain certificates covering your apex domain, www, and any domain aliases you add
• Wildcard certificates for subdomains, available when you use Netlify DNS
• Custom certificate upload if your organisation requires an EV or corporate-issued certificate

You only need to bring your own certificate in edge cases: compliance requirements, a certificate already purchased, or a domain that cannot pass Let’s Encrypt validation.

Step 1: Add the Custom Domain to Your Netlify Site

Before touching DNS, register the domain inside Netlify so it knows which project the certificate belongs to.

1. Open your project in the Netlify dashboard.
2. Go to Domain management (under Project configuration, previously labelled Site configuration).
3. Click Add a domain and enter your domain, for example example.com.
4. Netlify checks ownership. If the domain is already used on another Netlify account, you will be asked to verify it.
5. Choose your primary domain. Netlify will automatically redirect the other variant (apex to www, or www to apex) with a 301.

Important: the certificate is only requested for domains listed here. If you plan to serve shop.example.com too, add it as a domain alias before provisioning, otherwise the certificate will not cover it.

Step 2: Choose Your DNS Approach

There are two supported paths, and choosing the right one prevents 90% of SSL headaches.

Option	How it works	Best for
Netlify DNS (nameserver delegation)	You change the nameservers at your registrar to Netlify’s. Netlify manages all records.	Simplest setup, wildcard certificates, branch subdomains, apex domains without CNAME issues.
External DNS (records only)	You keep your current DNS provider and add an A record and a CNAME manually.	Domains with existing mail, subdomains on other hosts, or a DNS provider you must keep.

Option A: Point Your Registrar Domain to Netlify Nameservers

1. In Domain management, click your domain and select Set up Netlify DNS.
2. Netlify scans your existing records and offers to copy them across. Review this carefully: MX records for email and TXT records for SPF/DKIM must be recreated, or your email stops working.
3. Netlify shows four nameservers in the format dns1.p0X.nsone.net through dns4.p0X.nsone.net. The number in the middle differs per account, so always copy the exact values shown to you.
4. Log in to your registrar (Namecheap, GoDaddy, OVH, Google Domains successor, etc.) and replace the existing nameservers with all four Netlify ones.
5. Save and wait. Nameserver changes typically resolve in 15 minutes to a few hours, occasionally up to 24 hours.

Critical detail: if your registrar has DNSSEC enabled, disable it before switching nameservers. A DNSSEC signature that no longer matches the new nameservers makes your domain unresolvable, and Let’s Encrypt validation will fail silently.

Option B: Keep Your DNS Provider and Add Records Manually

If you would rather not delegate the whole zone, add these records at your current DNS host:

Host	Type	Value
@ (apex, example.com)	A	75.2.60.5
@ (apex, if ALIAS/ANAME supported)	ALIAS / ANAME / CNAME flattening	your-site-name.netlify.app
www	CNAME	your-site-name.netlify.app

Notes that matter:

• Use the ALIAS/ANAME record if your provider supports it (Cloudflare, DNSimple, Route 53 and others do). It follows Netlify’s load balancer better than a static IP.
• Always point the CNAME at the .netlify.app hostname, never at a deploy preview URL or a raw IP.
• Delete any leftover AAAA records from your previous host. Netlify does not serve on IPv6 for custom domains via A records, and a stale AAAA record breaks validation.
• Keep the TTL low (300 seconds) while you are setting things up, then raise it later.

Step 3: Let the Let’s Encrypt Certificate Provision

Once DNS resolves to Netlify, go to Domain management > HTTPS. You should see one of these states:

• Waiting on DNS propagation – normal, give it time
• Verify DNS configuration – click it to force a re-check
• Your site has HTTPS enabled – done, with the certificate domains and expiry date listed

Provisioning usually completes within a few minutes of DNS resolving correctly. When the certificate is live, enable these two toggles:

1. Force HTTPS – redirects all HTTP traffic to HTTPS with a 301.
2. HSTS (optional) – tells browsers to only ever use HTTPS. Only enable it once you are certain every subdomain you serve has a valid certificate, because it is hard to undo.

Why Netlify SSL Provisioning Fails: The Real Causes

The classic error is: “We could not provision a Let’s Encrypt certificate for your custom domain.” Here is what is actually behind it, in order of frequency.

1. DNS Has Not Propagated Yet

Let’s Encrypt performs an HTTP-01 validation request against your domain. If the record has not propagated globally, validation fails. Check with:

dig example.com +short
dig www.example.com CNAME +short

The apex should return 75.2.60.5 (or a Netlify load balancer IP) and www should return your .netlify.app hostname. If it does not, the problem is at your registrar, not at Netlify.

2. A CAA Record Is Blocking Let’s Encrypt

This is the silent killer. If your domain has a CAA record from a previous host or certificate authority, Let’s Encrypt is not authorised to issue. Check it:

dig example.com CAA +short

If any CAA record exists, you must add one for Let’s Encrypt:

example.com. CAA 0 issue "letsencrypt.org"

Or remove the CAA records entirely if you do not need them. Then wait for the TTL to expire before retrying.

3. One Domain on the Certificate Does Not Resolve

Netlify requests a single certificate covering your primary domain plus every domain alias. If even one of those aliases fails validation, the entire certificate fails. This is extremely common when someone adds blog.example.com as an alias but never creates the DNS record for it.

Fix: remove any alias you are not actively pointing at Netlify, then retry provisioning.

4. A Proxy Sits in Front of Netlify

If you use Cloudflare with the proxy (orange cloud) enabled, Cloudflare terminates SSL itself and Let’s Encrypt cannot validate against Netlify’s servers. Two ways out:

• Set the records to DNS only (grey cloud) so validation can reach Netlify, then re-enable proxying afterwards if you want, using Cloudflare’s Full (strict) SSL mode.
• Or leave Cloudflare proxied permanently and rely on Cloudflare’s own certificate, in which case Netlify’s certificate is not needed for the public-facing hostname.

Never run Cloudflare Flexible SSL in front of Netlify: it causes redirect loops.

5. Leftover Records From the Old Host

Stale AAAA, duplicate A records, or a wildcard record pointing somewhere else will send validation traffic to the wrong server. Your zone should contain exactly one A (or ALIAS) for the apex and one CNAME for www that relate to the website.

6. Let’s Encrypt Rate Limits

If you have been deleting and re-adding the domain repeatedly, you may hit Let’s Encrypt limits: 50 certificates per registered domain per week and 5 duplicate certificates per week. There is no workaround other than waiting for the rolling window to clear. Stop retrying and come back the next day.

7. Newly Registered Domain Confusion

A brand-new domain has a 60-day ICANN transfer lock. This does not block SSL and does not block nameserver changes. If someone tells you the lock is why your certificate fails, they are conflating two different things. Nameservers can be changed on day one.

8. Domain Registered Through Netlify but Zone Deleted

If you removed the Netlify DNS zone but kept the nameservers at the registrar, the domain resolves to nothing. Recreate the zone or repoint the nameservers.

How to Force a Certificate Renewal When It Gets Stuck

Sometimes DNS is perfect and the certificate is still showing an old domain list, an expired date, or a stubborn error. Here is the escalation ladder, from least to most disruptive.

Level 1: Verify DNS Configuration

In Domain management > HTTPS, click Verify DNS configuration. This re-runs the check and, if it passes, triggers a fresh provisioning attempt. Do this first, and wait a minute or two before doing anything else.

Level 2: Renew Certificate

On the same panel, once a certificate exists, a Renew certificate button appears. Use it when:

• You added or removed a domain alias and the certificate does not cover it yet
• The certificate is within its renewal window but has not auto-renewed
• You fixed a CAA or DNS issue and want an immediate retry

The button is rate-limited, so it may be greyed out for up to an hour after a previous attempt. That is expected behaviour, not a bug.

Level 3: Remove and Re-add the Certificate

If provisioning is genuinely wedged:

1. Confirm DNS resolves correctly for every domain on the site.
2. Remove any alias that does not resolve.
3. In the HTTPS panel, remove the existing certificate.
4. Click Verify DNS configuration again to trigger a clean issuance.

Expect a short window where the site serves an invalid certificate. Do this outside business hours if the site is live.

Level 4: Clear the Browser and Edge Cache

A renewed certificate may still look old to you because of local caching. Test the real state from the command line rather than trusting the browser:

openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -dates -subject

This prints the actual issuance and expiry dates being served. If they are fresh, your browser is the problem, not Netlify.

Level 5: Contact Support With the Right Details

If everything above is clean and the certificate still fails, open a support ticket and include the site name, the exact domain list, the output of your dig commands, and the timestamp of your last provisioning attempt. This turns a three-day thread into a one-reply resolution.

Wildcard and Subdomain Certificates

If you serve multiple subdomains, wildcard coverage is far cleaner than adding aliases one by one. A wildcard certificate covering *.example.com requires Netlify DNS, because Let’s Encrypt validates wildcards with a DNS-01 challenge and Netlify needs control of the zone to write the TXT record.

• Using Netlify DNS: wildcard is provisioned automatically when applicable, including branch deploy subdomains such as staging.example.com.
• Using external DNS: each subdomain must be added individually as a domain alias with its own CNAME record.

Using Your Own SSL Certificate Instead

If you must install a purchased or corporate certificate, go to Domain management > HTTPS and choose Set custom certificate. You will need three PEM-formatted blocks:

1. The certificate itself
2. The private key (unencrypted, no passphrase)
3. The intermediate certificate chain from your CA

Requirements to check before pasting:

• The certificate’s common name or SAN entries must match every domain configured on the site
• The key must not be password protected
• The chain must be complete, otherwise mobile browsers will throw errors even when desktop looks fine

Custom certificates do not auto-renew. Put the expiry date in a calendar now.

Quick Diagnostic Checklist

Symptom	Most likely cause	Fix
“Could not provision a Let’s Encrypt certificate”	DNS not resolving, or a CAA record	Check dig output and CAA records, then Verify DNS configuration
“Waiting on DNS propagation” for hours	Nameservers not fully updated or DNSSEC mismatch	Confirm all four nameservers at the registrar, disable DNSSEC
Certificate valid for www but not apex	Missing or wrong A/ALIAS record	Add the apex record, then renew the certificate
Redirect loop on HTTPS	Cloudflare Flexible SSL mode	Switch Cloudflare to Full (strict)
Subdomain shows certificate warning	Subdomain not on the certificate	Add it as a domain alias or move to Netlify DNS for a wildcard
Renew button greyed out	Rate limiting after a recent attempt	Wait up to one hour and retry

Best Practices Worth Adopting

• Set up DNS before adding aliases. Every alias must resolve or the whole certificate fails.
• Lower your TTL to 300 seconds a day before migrating, then raise it after everything is stable.
• Pick one canonical domain and let Netlify handle the redirect, rather than configuring redirects in two places.
• Do not enable HSTS on day one. Wait until the certificate has been stable for a week.
• Monitor expiry. Auto-renewal is reliable, but a simple uptime monitor with SSL checks costs nothing and catches edge cases.

FAQ

Does Netlify allow custom domains?

Yes. Every Netlify plan, including the free tier, supports custom domains, domain aliases, and subdomains. You can either delegate your domain to Netlify DNS or keep your existing DNS provider and add records manually.

Is SSL free on Netlify?

Yes. Netlify provisions and renews Let’s Encrypt certificates at no cost on all plans, for custom domains included. You only pay if you choose to bring a commercial certificate you purchased elsewhere.

How long does Netlify take to issue an SSL certificate?

Usually a few minutes after DNS resolves correctly. The variable part is DNS propagation, which can range from 15 minutes to 24 hours depending on your registrar and previous TTL values.

Why does my Netlify SSL certificate keep failing?

In order of likelihood: DNS not yet propagated, a CAA record that excludes letsencrypt.org, a domain alias that does not resolve, a proxy such as Cloudflare intercepting validation, leftover AAAA records, or Let’s Encrypt rate limits from repeated retries.

Can one SSL certificate cover multiple domains?

Yes. Netlify issues a single certificate with multiple SAN entries covering your primary domain and all domain aliases. If you use Netlify DNS, you can also get wildcard coverage for subdomains.

How do I force Netlify to renew a certificate?

Open Domain management, go to the HTTPS section, and use Verify DNS configuration followed by Renew certificate. If it stays stuck, remove the certificate and let Netlify provision a fresh one after confirming that every configured domain resolves.

Do I have to use Netlify nameservers?

No. External DNS works fine with an A or ALIAS record on the apex and a CNAME on www. Netlify nameservers are only mandatory for wildcard certificates and automatic branch subdomains.

Wrapping Up

Netlify custom domain SSL is genuinely automatic when DNS is clean. When it is not, the failure is nearly always upstream: a CAA record, a stale AAAA, a proxy in the path, or an alias pointing nowhere. Work through the diagnostic checklist above before deleting anything, use Verify DNS configuration then Renew certificate as your standard recovery move, and keep an eye on Let’s Encrypt rate limits if you have been retrying aggressively.