Shopify SSL Certificate Pending or Not Working: Causes and Fixes

When you connect a custom domain to Shopify, the platform issues an SSL certificate for it automatically. Usually you never think about it. When it gets stuck, the Domains page shows the certificate as pending, and visitors may see "Your connection is not private" or a connection error on your own domain. This guide explains what has to be true for issuance to succeed, how to test each condition from outside, and what to try when it does not.

How the certificate gets issued

A certificate authority will only issue a certificate for a hostname after the requester proves control of it. For Shopify-hosted stores that proof relies on the domain's DNS pointing at Shopify. In practice that means:

1. The domain must be added in Settings, Domains.
2. The DNS records must point at Shopify (the root A record and the www CNAME). If you are not sure they do, see Shopify custom domain DNS setup.
3. Nothing in the path may stop the authority from validating: no conflicting records, no restrictive CAA record, no proxy that answers in Shopify's place.
4. Time must pass for the request to be processed.

Pending status therefore means one of two things: the process has not completed yet, or one of the conditions above is false. Work through them in order, cheapest check first.

Step 1: Confirm DNS resolves to Shopify, from several places

Local results can be stale. Query a public resolver and compare:

dig +short A example.com @8.8.8.8
dig +short A example.com @1.1.1.1
dig +short CNAME www.example.com @8.8.8.8
dig +short AAAA example.com @8.8.8.8

You want a single answer matching the values in your admin. Problems to look for:

• Two A records on the root, one old. Delete the old one.
• An AAAA record that does not belong to Shopify. Delete it, since it can send validation traffic or visitors to the old server over IPv6.
• A www CNAME pointing somewhere else, such as the old host or a website builder.
• No answer at all: the record is in the wrong DNS zone. Find the live nameservers with the नेमसर्वर लुकअप and edit there.

The DNS चेकर shows the same lookups from multiple regions, which helps when some resolvers are still returning cached old data. If your change is recent, wait out the previous TTL; see how long DNS propagation takes.

Step 2: Check for CAA records

CAA records list which certificate authorities may issue for a domain. If one exists and it does not include the authority Shopify uses, issuance is refused and the status can remain pending indefinitely.

dig +short CAA example.com
dig +short CAA www.example.com

No output means no CAA restriction, which is fine. If you do get output, compare it with Shopify's current documentation on which authority must be allowed, add it, or remove the restrictive record if nobody needs it. CAA is inherited down the tree, so a record on the root also applies to www. Mention this to anyone managing security policy for the domain: CAA records are often put there on purpose, and they may be handled by a different team.

Step 3: Take proxies and "helpful" features out of the path

Anything that answers HTTP or DNS for your hostnames in place of Shopify can break validation.

• Cloudflare proxy (orange cloud). Switch the Shopify records to DNS only while the certificate issues, then follow Shopify's current guidance on whether a proxy is supported at all for stores. Do not enable "Always Use HTTPS" or page rules that redirect /.well-known/ paths while troubleshooting. Cloudflare setup, DNS and SSL modes explains the settings.
• Registrar forwarding or parking. Domain forwarding services publish their own records and their own certificate. Disable them for the hostnames you are connecting.
• Old web hosting. If the old host still answers on the same hostname through leftover records, validation requests may reach it instead.
• Website builders (a previous Wix, Squarespace or GoDaddy site) that kept a record alive.

After removing anything suspicious, give DNS a short while, then recheck Step 1.

Step 4: See what the browser and the server actually return

When the status looks right in the admin but the browser complains, collect facts before guessing.

curl -vI https://www.example.com/ 2>&1 | head -n 30
openssl s_client -connect www.example.com:443 -servername www.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

Interpret the results:

The SSL Checker displays the subject, issuer, expiry and chain from outside your network. If it reports chain problems, the SSL Chain Debugger will point to a missing intermediate. For Shopify-managed certificates that is unusual, and it more often indicates you are looking at a different server.

Step 5: Remove and re-add the domain

If DNS is clean, CAA is clear, no proxy is involved and a reasonable amount of time has passed, a reset is a legitimate step. In Settings, Domains, remove the domain and add it again, then re-verify. This forces Shopify to restart the issuance process. Do it while no campaign is running, since the domain will briefly not be attached to the store; if your shop is the live storefront on that domain, plan the change for a quiet period and tell your team.

If it still does not issue, contact Shopify Support with the output of the dig commands above, the exact hostnames and the time you added them. Evidence of correct DNS gets a faster answer than "the certificate is pending".

Problems that look like certificate failures but are not

Mixed content warnings

The padlock is missing or the browser says "not fully secure" even though the certificate is valid. This is usually a theme, app or page that loads an image, script or font over http://. The मिक्स्ड कंटेंट चेकर lists the offending URLs and how to fix mixed content covers the cleanup. In Shopify, look in theme files, hard-coded image links in rich text and third-party app snippets.

The wrong domain is primary

If shoppers reach the store through a hostname that is not connected or is not the primary, they may be redirected to a different address or see a warning for the other one. Check which domain is marked primary and test both versions with the HTTP स्टेटस चेकर.

HSTS and browser caching

If you previously served the domain over HTTPS with a strict policy elsewhere and then moved, browsers can remember it. Test in a private window or another device, and use the HSTS चेकर to see what policy the domain currently sends. Do not try to preload or lengthen HSTS until everything is stable; HSTS preload guide covers the risks.

A different subdomain

A certificate covers the names that were validated. If shoppers use shop.example.com or m.example.com and you never connected it, it will show a name mismatch. Connect each hostname you intend to use or redirect it at DNS level to one that is connected.

Monitor it so you find out first

An expiring or broken certificate usually shows up as lost sales before it shows up as a support ticket. Add an HTTPS monitor with certificate expiry alerts in the uptime monitor for your primary domain and for www. See SSL and TLS certificate errors explained for what each browser error means.

अगले कदम

• Look up your live certificate with the SSL Checker.
• Compare resolvers with the DNS चेकर.
• Review the record setup in Shopify custom domain DNS setup.
• Get expiry and downtime alerts from the uptime monitor.

सामान्य प्रश्न

How long does Shopify take to issue an SSL certificate?

Shopify documents an expected window in its Help Center, and it can change, so read the current page. If DNS is correct and the status is still pending well beyond that window, work through the checklist above and contact Support.

Do I have to buy an SSL certificate for a Shopify store?

No. Shopify provisions a certificate for connected domains as part of the platform. You only need correct DNS and nothing in the way of validation.

Why does my store show "not secure" when the certificate is valid?

Look for mixed content: an HTTP image, script or stylesheet on an HTTPS page. The browser's developer console names each blocked or insecure resource.

Can a CAA record cause a pending certificate?

Yes. A CAA record that omits the authority Shopify uses will cause issuance to be refused. Check with dig +short CAA example.com and update or remove the record.

Will removing and re-adding the domain cause downtime?

It can briefly detach the domain from the store, so shoppers may see an error until you reconnect it. Do it at a quiet time and have your DNS records ready.

यह पेज सामान्य जानकारी है, जिसे हमारी संपादकीय टीम ने लिखा है और दस्तावेज़ीकरण बदलने पर अपडेट किया जाता है। सर्वर और प्रदाता अलग-अलग होते हैं, इसलिए बदलाव पहले सुरक्षित तरीके से जाँचें। देखें: संपादकीय नीति और अस्वीकरण.