Shopify SSL Pending: Causes and How to Fix It

-

Quick Answer

The SSL Pending status in your Shopify domain settings means Shopify is unable to automatically issue or provision a free Let's Encrypt TLS/SSL certificate for your custom domain. When you first point a custom domain to Shopify, SSL provisioning usually takes a few hours, but global DNS changes can take up to 48 hours to fully finalize. If the status remains stuck on SSL Pending beyond 48 hours, the issue is almost always caused by incorrect DNS records—such as missing or extra A records, incorrect CNAME hostnames, active DNSSEC configurations, external proxying, or restrictive CAA records at your domain registrar.

Abstract digital vector rendering of network security nodes, encryption locks, and web server domain routing paths.

To fix the issue quickly, ensure your root domain points exclusively to Shopify's IP address (23.227.38.65), your www record points to shops.myshopify.com, disable DNSSEC at your registrar, remove conflicting IPv6 (AAAA) records, and allow sufficient propagation time.

Symptoms of Shopify SSL Pending

When your domain experiences an SSL provisioning hold on Shopify, you will typically observe the following symptoms:

  • Shopify Admin Status: Under Online Store > Domains, your connected custom domain displays a yellow badge reading "SSL Pending" or "SSL unavailable" instead of a green "Connected" status.
  • Browser Security Warnings: Visitors reaching your store over https:// encounter severe browser security alerts, such as "Your connection is not private" or ERR_SSL_VERSION_OR_CIPHER_MISMATCH.
  • Subdomain Inconsistencies: Your root domain (e.g., yourstore.com) might render an SSL error while the www version works, or vice versa, due to partial DNS configuration.

Primary Causes of SSL Pending Errors

Automated certificate authorities like Let's Encrypt validate domain ownership before issuing certificates. If external DNS responses send invalid routing details or block validation bots, Shopify cannot issue the certificate. According to Shopify support documentation, the primary root causes include:

  • Incorrect Primary A Record: Pointing your root domain to a hosting server other than Shopify's designated IP address.
  • Multiple A or AAAA Records: Having extra A records or third-party AAAA (IPv6) records left over from previous web hosts (such as WordPress, Wix, or Squarespace).
  • Active DNSSEC Security: Enabling Domain Name System Security Extensions (DNSSEC) at your third-party domain registrar. Shopify does not currently support DNSSEC for custom domains, which causes cryptographic validation failures during automated certificate issuance.
  • External Proxy Services: Route configurations running active proxying—such as Cloudflare's orange-cloud proxying—which intercept validation requests meant for Shopify's infrastructure. If you use external edge networks, you may encounter issues similar to Cloudflare Error 522 if routing isn't aligned with target servers.
  • Restrictive CAA Records: Using Certification Authority Authorization (CAA) DNS records that restrict certificate issuance to specific vendors while omitting Let's Encrypt.
  • DNS Propagation Delays: Expecting immediate issuance right after saving DNS settings. Full worldwide DNS record updates can take up to 48 hours.

Diagnosis: Checking Your DNS Configuration

Before modifying DNS settings, diagnose your domain's live DNS records using a terminal command or an online lookup tool like dig or nslookup.

Step 1: Check Apex (Root) A Records

Run the following command in your terminal to see which IPv4 addresses your domain points to:

dig +short yourstore.com A

If the result returns multiple IP addresses or any address other than 23.227.38.65, your A records are improperly configured.

Step 2: Check for Extra IPv6 (AAAA) Records

Check if your domain has active IPv6 addresses assigned:

dig +short yourstore.com AAAA

If this command returns any IP addresses pointing to external web hosts, they must be removed, as Shopify manages IPv6 traffic through its primary routing mechanism.

Step 3: Check the CNAME Record for Subdomains

Verify that your www record points directly to Shopify:

dig +short www.yourstore.com CNAME

The output should resolve to shops.myshopify.com..

How to Fix the Shopify SSL Pending Error

Follow these step-by-step procedures at your third-party domain registrar (such as GoDaddy, Namecheap, Google Domains/Squarespace, or Domain.com) to resolve the underlying configuration conflicts.

Fix 1: Standardize Your A and CNAME Records

Access the DNS Management panel at your domain provider and adjust your records to match Shopify's standard requirements:

  • Apex Record: Set the Host or Name field to @ (or leave it blank, depending on your registrar), select record type A, and set the value to 23.227.38.65. Delete any secondary A records.
  • WWW Record: Set the Host or Name field to www, select record type CNAME, and set the target value to shops.myshopify.com.

Warning: Removing extra A or CNAME records deletes previous server pointers. If you previously ran legacy services on those records, ensure they are backed up or migrated before deletion. Changing DNS records will cause temporary routing updates while caches clear globally.

Fix 2: Remove All AAAA (IPv6) Records

Look through your DNS zone table for any record listed with the type AAAA under the root (@) or www hostnames. Delete all non-Shopify AAAA records completely. Leftover AAAA records frequently cause certificate validation requests to fail by sending verification traffic to dead IPv6 addresses.

Fix 3: Disable DNSSEC at Your Registrar

Shopify official documentation notes that DNSSEC (DNS Security Extensions) must be turned off for custom domains pointed to Shopify stores. Active DNSSEC records create signature validation conflicts when Shopify attempts to provision TLS certificates.

  1. Log in to your domain registrar's administration dashboard.
  2. Navigate to your domain's Advanced Security or DNS Management settings.
  3. Locate the DNSSEC section and toggle it to Disabled or select Remove DNSSEC Keys.
  4. Save your changes.

Caution: Disabling DNSSEC removes DNS response signature verification at your registrar level, but it is a strictly necessary step to allow Shopify's automated certificate authority to complete domain ownership verification.

Fix 4: Update or Remove CAA Records

If your domain uses Certification Authority Authorization (CAA) records to restrict which certificate authorities (CAs) can issue certificates for your domain, you must explicitly permit Let's Encrypt (Shopify's SSL provider).

Either remove existing CAA records entirely, or add a specific CAA entry with the following details:

  • Name/Host: @
  • Type: CAA
  • Flag: 0
  • Tag: issue
  • Value: "letsencrypt.org"

Fix 5: Disable Cloudflare Orange-Cloud Proxying

If you route your domain through a third-party Cloudflare account, keeping the DNS proxy feature active ("Orange Cloud") alters incoming validation traffic. Unless you are using official enterprise-level integrations, disable proxying for your Shopify DNS records by clicking the proxy toggle so it shows DNS Only ("Grey Cloud"). This allows direct, unhindered communication between Shopify and Let's Encrypt validation bots.

Verifying the Fix

Once you have saved your DNS changes and disabled conflicting features, perform the following verification steps:

  1. Force Shopify Re-Check: In your Shopify admin, go to Settings > Domains. Select your domain and click Verify Connection to trigger an immediate automated scan of your DNS records.
  2. Confirm Certificate Status: Allow up to 48 hours for global propagation. Once verified, the badge under Settings > Domains will change to a green Connected or Active status.
  3. Test SSL in Browser: Open a private or incognito browser window and visit your domain via https://yourstore.com. Click the padlock icon in the browser address bar to verify that a valid Let's Encrypt TLS certificate is active.

When to Contact Support

If your DNS configuration matches Shopify's requirements exactly (single A record pointing to 23.227.38.65, CNAME pointing to shops.myshopify.com, no AAAA records, and DNSSEC disabled) and more than 48 hours have passed without status resolution, take the following actions:

  • Contact Your Domain Registrar: Ask support to confirm there are no backend registry holds, lock statuses, or stale DNSSEC keys remaining in parent TLD zone files.
  • Contact Shopify Support: Reach out through the official Shopify Help Center so support advisors can manually re-trigger the Let's Encrypt provisioning hook for your shop domain.

Sources & References

Comments

Post a Comment

Popular posts from this blog

Cloudflare Error 522 (Connection Timed Out): Causes and How to Fix It

-
If visitors to your site are seeing a page that says "Error 522: Connection timed out," the problem isn't with their browser or internet connection — it's with the connection between Cloudflare and your website's origin server. This error means Cloudflare tried to reach your server but never got a response in time. The good news is that Error 522 is usually fixable once you know where to look. This guide explains what triggers Error 522, walks through diagnostic steps in order from easiest to most technical, and shows you how to confirm the fix worked. Quick Answer Error 522 happens when Cloudflare cannot complete a TCP connection with your origin server within its timeout window. The most common causes are an overloaded or crashed server, a firewall blocking Cloudflare's IP addresses, incorrect DNS records pointing to the wrong server, or network-level congestion between Cloudflare and your host. Start by checking whether your server is actually online ...
Read more

WooCommerce Checkout Stuck Loading: Causes and How to Fix It

-
When a WooCommerce checkout page gets stuck on an endless loading spinner, customers cannot complete purchases, calculate shipping, or view available payment gateways. Because this glitch directly interrupts transactions, resolving it quickly is critical to preventing lost revenue and cart abandonment. Quick Answer: How to Fix a Stuck WooCommerce Checkout An endless checkout spinner usually indicates that an asynchronous JavaScript (AJAX) request to the ?wc-ajax=update_order_review endpoint has failed, stalled, or returned invalid data. Follow these quick troubleshooting steps to identify and resolve the failure: Inspect Browser DevTools: Open the Network and Console tabs to inspect the update_order_review call for JavaScript syntax errors, 403 Forbidden statuses, or 500 Internal Server errors. Match Site URLs: Go to Settings > General in WordPress and verify that WordPress Address (URL) and Site Address (URL) share the exact same protocol ( https:// ) and domain ...
Read more

Shopify Checkout Not Working: Causes, Diagnostics, and Fixes

-
Image
Quick Answer When a Shopify checkout stops working, the issue is usually tied to inactive or misconfigured payment gateways, missing shipping rates for specific geographic zones, or third-party app script conflicts. To resolve the failure quickly, first check the Abandoned checkouts section in Shopify Admin to identify exact payment decline codes. Next, verify that your active payment provider credentials are correct and ensure that your shipping profiles contain valid rates for all target regions. If the checkout button is unresponsive, preview your store using an unmodified default theme (such as Dawn) to test for app or custom code conflicts. Common Symptoms Checkout failures on Shopify manifest in several distinct ways depending on the underlying technical cause: Payment Failure Banner: Buyers see the explicit message "This store is currently unable to accept payments" upon proceeding to checkout. Shipping Error at Checkout: The system displays an error stating that...
Read more