Yes, Shopify provides a free SSL certificate on every plan (Basic, Shopify, Advanced, and Plus) at no extra cost. The certificate is issued by Let’s Encrypt and managed entirely by Shopify, so there is nothing to buy, install, or renew. The moment you connect a custom domain with correct DNS settings, Shopify provisions the certificate automatically. What most store owners actually need help with is checking that it activated, understanding what “SSL pending” or “SSL unavailable” means, forcing HTTPS site-wide, or diagnosing why the padlock isn’t showing. This guide covers all of it.

Key Takeaways
1
Shopify provides a free SSL certificate on every store, every plan, with no setup or renewal needed.
2
SSL provisions automatically once your custom domain’s DNS is pointing correctly at Shopify (usually within 48 hours).
3
Most “SSL not working” issues on Shopify are DNS or mixed-content problems, not certificate problems.

Does Shopify Provide An SSL Certificate?

Yes. Every Shopify store gets a free SSL/TLS certificate, included on every plan from Basic through Plus. The certificate is issued by Let’s Encrypt and managed by Shopify, so you never have to buy one, install one, or renew one yourself. This applies to:

  • Your default your-store.myshopify.com domain (always secured automatically the moment the store is created)
  • Any custom domain you connect (secured automatically once DNS is pointing correctly)
  • Your checkout pages (always served over HTTPS on Shopify’s infrastructure)

You don’t need to buy an SSL certificate from a third party. In fact, Shopify doesn’t let you bring your own. The platform issues and manages the certificate for you, which is the whole point of using a hosted commerce platform like Shopify rather than running your own server.

Shopify SSL Certificate Requirements In 2026

There are no requirements to enable or pay for SSL on Shopify itself. The only thing required from the store owner is that the custom domain is correctly pointed at Shopify so the platform can issue the certificate. Specifically:

  1. Your domain’s A record for the root domain (yourdomain.com) points to Shopify’s IP 23.227.38.65.
  2. Your domain’s CNAME for www points to shops.myshopify.com.
  3. You’re not using “domain forwarding” at your registrar. Forwarding masks the domain and prevents Let’s Encrypt from validating it. Actual DNS records are required.
  4. Your domain has no CAA record that excludes Let’s Encrypt. If you have a CAA record set, it must include letsencrypt.org.

If those four things are true, Shopify will provision the certificate automatically. Usually within minutes, sometimes up to 48 hours.

What Is SSL And Why It Matters For Your Store

SSL (the underlying protocol is now technically TLS, though almost everyone still calls it SSL) is the standard for encrypting traffic between a shopper’s browser and your store’s server. It does three things that matter for an ecommerce store:

  • Encrypts checkout data so credit card numbers, addresses, and login credentials can’t be read in transit.
  • Signals trust visually through the browser padlock and the https:// prefix. Shoppers have been trained to look for the padlock before entering payment details.
  • Affects search rankings. Google has used HTTPS as a small ranking factor since 2014 and treats unsecured pages as lower-quality in the search index.

For a store that takes payments, SSL isn’t optional. It’s a baseline platform requirement that Shopify handles for you.

How To Check Your Shopify SSL Status

To confirm SSL is active on your store, check in two places.

Inside the Shopify admin:

  1. Open your Shopify admin and go to Settings > Domains.
  2. Find your custom domain in the list.
  3. Look for the green SSL certificate indicator next to the domain name. A green check means the certificate has been issued and is active.
  4. If you see “SSL pending” or “SSL unavailable”, the certificate hasn’t been issued yet. See the troubleshooting sections below.

In the browser:

  1. Open your storefront in Chrome or Safari.
  2. Look at the address bar. You should see https:// in front of your domain and a closed padlock icon to the left of it.
  3. Click the padlock and choose “Connection is secure” or “View certificate” to confirm the certificate is valid and issued by Let’s Encrypt.

If both checks pass, your Shopify SSL certificate is working as expected.

Force HTTPS Across Your Store

Shopify automatically redirects every page on your storefront from http:// to https:// once SSL is active. This happens at the platform level, so you don’t need to add any redirect rules yourself. Visitors who type http://yourdomain.com will land on the secured version every time.

What this means in practice:

  • You can’t disable the HTTPS redirect on Shopify (and you shouldn’t want to).
  • Internal links inside your theme should use protocol-relative or HTTPS URLs to avoid mixed-content warnings even though Shopify will redirect them.
  • External backlinks pointing at http:// versions of your pages will still pass authority through the redirect, so older inbound links remain useful after SSL goes live.

What Does “Provisioning TLS Certificate” Mean on Shopify?

If you open Settings > Domains and see the message “Provisioning TLS certificate for secure connections” next to your domain, it means Shopify has started the certificate request with Let’s Encrypt but the process isn’t complete yet. No certificate is active at this point, and visitors to your store may see a browser security warning until it finishes.

This status typically appears right after you connect a custom domain or after Shopify initiates a certificate renewal. In most cases it clears within a few minutes to a few hours. The outer limit before something is genuinely wrong is 48 hours.

Why it stays stuck longer than expected:

  • DNS hasn’t propagated yet. Let’s Encrypt validates your domain by checking that the DNS records resolve to Shopify’s servers. If you just changed your A record or CNAME, the old values may still be cached globally. This usually resolves on its own within an hour.
  • DNS records are misconfigured. If the A record isn’t pointing to 23.227.38.65 or the CNAME isn’t set to shops.myshopify.com, Let’s Encrypt can’t validate the domain and the provisioning status will never clear.
  • A CAA record is blocking Let’s Encrypt. If your domain has a CAA record that doesn’t include letsencrypt.org, the certificate request will be rejected and provisioning will stall indefinitely.

If “Provisioning TLS certificate” has been showing for more than 48 hours, work through the DNS checklist in the troubleshooting section below. The fix is almost always a DNS configuration issue, not a problem on Shopify’s end.

Shopify SSL Pending: Why It Happens and How To Fix It

“SSL pending” in Settings > Domains means Shopify has queued a certificate request but Let’s Encrypt hasn’t been able to validate and issue it yet. The certificate is in progress; it’s not a failure state on its own, but if it stays pending past 48 hours, something is blocking the validation.

How long does Shopify SSL take to activate?

For most stores, SSL activates within a few minutes of connecting a custom domain. The outer bound is 48 hours. Three things affect timing:

  1. DNS propagation. If you just changed your A or CNAME records, they need to propagate globally before Let’s Encrypt can validate the domain. This is usually under an hour but can take longer depending on your registrar’s TTL.
  2. Whether DNS is correctly configured. If the records are wrong, the certificate will never issue, no matter how long you wait.
  3. Whether there’s a CAA record blocking Let’s Encrypt. If so, the certificate request will be rejected immediately and stay pending indefinitely.

Steps to fix Shopify SSL stuck on pending

Step 1: Verify your DNS records

Open your domain registrar and confirm:

  • A record for @ (the root) points to 23.227.38.65.
  • CNAME for www points to shops.myshopify.com.
  • There are no other A records for the root domain pointing somewhere else.

Use a tool like dnschecker.org to verify the records are visible globally, not just from your own machine.

Step 2: Check for domain forwarding

If your registrar is “forwarding” the domain instead of pointing DNS at Shopify, the certificate will never issue. Forwarding hides your domain behind an HTTP redirect, and Let’s Encrypt can’t validate a domain that doesn’t resolve to the actual Shopify server. Disable forwarding and replace it with proper A and CNAME records.

Step 3: Check your CAA record

A CAA (Certification Authority Authorization) record tells the world which certificate authorities are allowed to issue certificates for your domain. If you have a CAA record that doesn’t include letsencrypt.org, Let’s Encrypt will refuse to issue, and Shopify’s certificate request will stay pending. Either remove the CAA record entirely (most stores don’t need one) or add letsencrypt.org to the list of permitted issuers.

Step 4: Disconnect and reconnect the domain

If everything looks correct but the certificate is still stuck after 48 hours, remove the domain from Settings > Domains and reconnect it. This triggers a fresh certificate request and clears any cached failure state on Shopify’s side.

Step 5: Contact Shopify support

If you’ve confirmed all of the above and the certificate still won’t issue, open a Shopify support ticket. Include the exact text of the admin error, screenshots of your DNS records, and the result of dig yourdomain.com. Support can manually trigger a reprovision from their side.

Shopify SSL Unavailable: What It Means

“SSL unavailable” is a different status from “SSL pending” and the distinction matters. Pending means the certificate is being requested and Shopify is waiting on Let’s Encrypt to validate and issue it. Unavailable means the certificate request was rejected or failed outright. Shopify is no longer actively trying.

When you see “SSL unavailable”, the certificate process has already concluded with an error, not just a delay. Common reasons:

  • DNS records were wrong at the time of the request. Let’s Encrypt attempted validation, found that the domain didn’t resolve to Shopify’s servers, and rejected the request. The domain may have been connected to Shopify before DNS had finished propagating.
  • A CAA record blocked the issuance. The request was attempted and immediately refused because letsencrypt.org wasn’t an authorized issuer for the domain.
  • The domain was flagged or unreachable. In rare cases, Let’s Encrypt rate limits, domain holds, or registrar-level locks can cause the request to fail.
  • The domain was moved or transferred. If the domain was transferred to a new registrar during provisioning, the nameservers may have temporarily changed, causing validation to fail mid-process.

How to fix “SSL unavailable” on Shopify:

The fix is the same as for pending, but you need to trigger a fresh attempt first because Shopify has stopped retrying. Confirm your DNS records are correct (A record to 23.227.38.65, CNAME to shops.myshopify.com, no domain forwarding, no blocking CAA record), then disconnect the domain from Settings > Domains and reconnect it. This forces a new certificate request from scratch.

If the domain reconnects but shows “unavailable” again within minutes (rather than transitioning to “pending” first), the DNS validation is failing immediately. Use dnschecker.org to confirm the records are fully propagated before reconnecting.

Fixing Mixed-Content Warnings

A “mixed content” warning means your page is served over HTTPS but loads at least one asset (image, script, stylesheet, embed) over plain HTTP. The padlock will turn into a warning icon, and some browsers will block the insecure resources outright. To fix it:

  1. Open the page in Chrome and press F12 to open DevTools.
  2. Click the Console tab and look for any “Mixed Content” warnings. Each one names the exact URL of the insecure resource.
  3. Track the URL back to its source. It’s usually a hardcoded http:// link inside a theme file, a product description, a blog post, or a third-party app’s embed code.
  4. Edit the source to use https:// instead, or change it to a protocol-relative URL (//example.com/image.jpg).
  5. Reload the page and confirm the padlock is back.

Most mixed-content warnings on Shopify come from old product images uploaded before SSL was enabled, or from third-party embed codes (analytics scripts, chat widgets, video players) that still use HTTP URLs. Updating the source fixes them permanently.

Is The SSL Certificate Included In Every Shopify Plan?

Yes. SSL is included on every Shopify plan, including the entry-level Basic plan, the standalone Shopify Starter plan, and Shopify Plus. There is no upgrade required and no add-on to purchase. The certificate is the same Let’s Encrypt domain-validated certificate across every plan, and the renewal cadence is identical.

Should I Use A Third-Party SSL Certificate On Shopify?

You can’t, and you wouldn’t want to. Shopify doesn’t support uploading or installing third-party SSL certificates. The platform manages SSL at the load-balancer level for every store on its infrastructure, which is why it can offer it free and renew it automatically. If you’re moving to Shopify from a platform where you paid for an SSL certificate, you can cancel that subscription. Shopify’s built-in certificate covers everything it did and costs nothing.