Why isn’t HTTPS working on my website?

Read the browser’s error before doing anything

The exact wording of the error is the diagnosis. Open the site in a private window, try both the bare domain and www, and find your case:

DNS has to point at the host before it can issue a certificate

Managed hosts prove to a certificate authority that they control the name by answering for it. Vercel says its certificate request only succeeds once DNS records are added and have propagated; Netlify says provisioning can’t complete until the domain’s DNS points to its servers and the old settings have expired from caches. So a certificate error immediately after a DNS change is expected for a while, and the length of that while is the old record’s TTL. Use the DNS-change guide to confirm the authoritative records are right; if they aren’t, the certificate will never come, and that’s the thing to fix.

The certificate is still being issued

With DNS right, look at the host’s domain screen. Cloudflare shows its certificate moving through Pending Validation, Pending Issuance and Pending Deployment to Active, and quotes 15 minutes to 24 hours after a domain becomes active on its DNS; if it times out, its documented fix is to switch the record to DNS only for a minute and back to proxied. Netlify shows a certificate “Waiting on DNS propagation” under Domain management, then HTTPS, and offers Provision certificate and Renew certificate buttons there. Vercel doesn’t publish a figure. In practice a certificate that hasn’t appeared an hour after the DNS was confirmed right has something blocking it, which is the rest of this guide. Don’t remove and re-add the domain to hurry it: Let’s Encrypt, which Vercel and Netlify use, limits how many certificates it will issue for the same names in a week, and repeated attempts can hit that limit.

Only one of the apex and www is attached

A certificate covers the names the host knows about. If only the bare domain was added to the project, www arrives at the host with no certificate for it, and the browser reports a name mismatch. Netlify includes an alias on the certificate only if its DNS was configured in advance; Vercel issues per domain you add. Add the missing name to the project, make sure its DNS record points at the host, and wait for the host to issue for it. The www guide covers the two names in full.

A CAA record is blocking issuance

A CAA record in your DNS lists which certificate authorities may issue for the domain. If one exists and doesn’t name the authority the host uses, issuance fails and stays failed. Vercel and Netlify use Let’s Encrypt; Vercel documents the exact record to add, 0 issue "letsencrypt.org", when other CAA records exist. Cloudflare uses several authorities and lists the values a CAA record must allow: letsencrypt.org, pki.goog, ssl.com and sectigo.com at the time of writing. Query the domain’s CAA records with a lookup tool; if there are any, add the host’s authority rather than deleting the record.

Cloudflare’s proxy or SSL mode is the cause

Three distinct problems, all fixed in the Cloudflare dashboard:

• The record is proxied and the host can’t validate. An outside host such as Netlify needs to terminate TLS itself and says proxying must be turned off before it can issue a certificate. Set the website records to DNS only (grey cloud).
• Too many redirects. With Cloudflare’s Flexible SSL mode, Cloudflare talks to the host over http, and a host that redirects http to https sends every request back around. Cloudflare’s own documentation on this error says to use Full or Full (strict).
• Error 525 or 526. Cloudflare tried to connect to the host over https and the handshake failed (525) or the host’s certificate was invalid (526). Either the host has no certificate for the name yet, or the mode is stricter than the host supports. Get the host’s own certificate issued first, then use Full (strict).

Old records are serving someone else’s certificate

If the browser reports a certificate for a different name, look at who answered. A leftover A or AAAA record pointing at the old host means the old host answered with its certificate, which doesn’t cover your domain any more, or with its default. A registrar’s “domain forwarding” at the apex answers with the registrar’s certificate. Query the authoritative A and AAAA records and remove anything that isn’t the new host; Vercel’s troubleshooting page says explicitly to remove outdated records to prevent conflicts. One more leftover to look for: a TXT record at _acme-challenge from a previous provider. Vercel notes that a stale one prevents any other provider from issuing. And if the browser offers no “proceed anyway” link on the error page, the site has HSTS turned on, which tells browsers never to accept a bad certificate for it; that changes nothing about the fix.

Mixed content: the page is secure, some of it isn’t

This one isn’t a certificate problem. The page loads over https, but an image, script or stylesheet in it is requested over plain http. Browsers block or warn about those parts, so you get a padlock with a warning, or missing images. The fix is in the site’s code or content: change the addresses to https, or to protocol-relative paths. It shows up most often after a move, when content still refers to the old host by its http address. A developer or coding agent can find every http reference in a minute.

An expired certificate on traditional or self-managed hosting

Managed hosts renew certificates automatically; Vercel, Netlify and Cloudflare all say so. An expiry error therefore points at a server someone manages by hand: a traditional web host with a control panel, a VPS, or a certificate that was bought and installed once. Let’s Encrypt certificates last 90 days by default and are getting shorter, so anything issued manually needs renewing on a schedule. Find who runs the server; the diagnostic guide finds the host from the DNS records. If it’s a control-panel host, its automatic certificate feature has usually been switched off or has failed validation for one of the reasons above.

Why buying a certificate is usually not the answer

On Vercel, Netlify and Cloudflare, certificates are issued and renewed for you at no charge, and the failures above are all configuration: DNS, names, CAA, proxy. A purchased certificate fixes none of them, and managed hosts either don’t accept an uploaded certificate on ordinary plans or make it an advanced option. Buying one is only relevant when you run your own server and want a certificate your server can present, and even then Let’s Encrypt’s free, automated certificates are the usual choice. If a support agent or a search result suggests purchasing an SSL certificate to fix a “not secure” warning on a managed host, go back to the table at the top instead.

Checklist

Sources

The rules and product behaviour described above were checked against these pages when the guide was last updated. If something here has changed, these are the places to look.

• Working with SSL · Vercel
• Domains troubleshooting · Vercel
• A record and CAA with Vercel · Vercel
• HTTPS (SSL) · Netlify
• Domain troubleshooting tips · Netlify
• Enable Universal SSL · Cloudflare
• Universal SSL troubleshooting · Cloudflare
• Certificate statuses · Cloudflare
• Certificate authorities and CAA records · Cloudflare
• Domain not generating SSL certificate · Vercel Knowledge Base
• Troubleshoot SSL and HTTPS · Netlify
• Certificate lifetimes · Let’s Encrypt
• Mixed content · MDN
• Strict-Transport-Security · MDN
• Too many redirects · Cloudflare
• Encryption modes · Cloudflare
• Cloudflare 5xx errors · Cloudflare
• Proxy status · Cloudflare
• Certificate Authority Authorization (CAA) · Let’s Encrypt
• Rate limits · Let’s Encrypt