Shopify SSL Pending: Causes and How to Fix It

Quick Answer

The SSL Pending or TLS Pending status in Shopify means that Shopify is still provisioning a TLS certificate for your custom domain, or that the domain's DNS configuration is preventing certificate issuance. For a newly connected third-party domain, TLS provisioning can take up to 48 hours.

For a manually connected third-party domain, verify that your DNS records match Shopify's current requirements:

• A record: Point the root domain to Shopify's IPv4 address 23.227.38.65. Shopify may provide a different valid regional Shopify IP address in your Domains settings.
• AAAA record: Point the root domain to Shopify's IPv6 address 2620:0127:f00f:5::.
• WWW CNAME: Point www to shops.myshopify.com.
• DNSSEC: Deactivate DNSSEC when connecting the domain to Shopify.
• Proxying: Remove unsupported third-party proxying, such as Cloudflare proxying, from records used to connect the domain to Shopify.
• CAA records: If your domain uses CAA restrictions, allow the certificate authorities required by Shopify: Let's Encrypt, Google Trust Services, and SSL.com.

Remove additional conflicting A or AAAA records, but do not remove Shopify's required AAAA record. After correcting the DNS configuration, allow up to 48 hours for DNS propagation and TLS certificate provisioning.

Symptoms of Shopify SSL Pending

When Shopify has not yet completed TLS certificate provisioning for a custom domain, you may notice one or more of the following symptoms:

• Pending status in Shopify: Under Settings > Domains, the domain may display an SSL Pending or TLS Pending status.
• SSL unavailable after the waiting period: If Shopify still cannot provision the certificate after the expected waiting period, the status may change to SSL Unavailable or TLS Unavailable.
• Browser security warnings: Visitors may see a message such as "Your connection is not secure" when opening the custom domain over HTTPS.
• Root and www behave differently: One hostname might work while the other does not if the A, AAAA, or CNAME records are incomplete or conflicting.

Primary Causes of SSL Pending Errors

Shopify automatically provides TLS certificates for domains connected to the platform. If certificate provisioning remains pending, the most common causes are DNS records that do not match Shopify's requirements or DNS features that interfere with validation.

• Incorrect A record: The root domain points to an old hosting provider or another service instead of Shopify.
• Incorrect or duplicate A/AAAA records: Additional records point some traffic away from Shopify or cause conflicting DNS responses.
• Incorrect AAAA record: The domain is missing Shopify's IPv6 record or uses an IPv6 address that belongs to another service.
• Incorrect www CNAME: The www record does not point to shops.myshopify.com.
• DNSSEC is enabled: Active DNSSEC can prevent Shopify from completing domain and certificate validation for a connected third-party domain.
• Unsupported third-party proxying: A proxy service can alter DNS responses or traffic in ways that interfere with Shopify's domain connection.
• Restrictive CAA records: CAA rules can block one or more certificate authorities that Shopify uses.
• DNS propagation: Recent DNS changes may not yet have propagated worldwide. Shopify advises allowing up to 48 hours.

Diagnosis: Check Your DNS Configuration

Before changing anything, inspect the domain's live DNS records. You can use command-line tools such as dig or nslookup, or a reputable public DNS lookup service.

Step 1: Check the Root A Record

Run:

dig +short yourstore.com A

For a standard manual Shopify connection, the result should point to Shopify. The default IPv4 address is:

23.227.38.65

Shopify can assign a different valid regional address with a different final number, so if the IP shown in Settings > Domains differs slightly from the default, follow the value Shopify provides for your store.

If unrelated A records point to an old host or another ecommerce platform, remove the conflicting records.

Step 2: Verify the Shopify AAAA (IPv6) Record

Run:

dig +short yourstore.com AAAA

The Shopify IPv6 address for a manually connected root domain is:

2620:0127:f00f:5::

If your DNS provider does not accept the condensed IPv6 format, use the expanded form:

2620:0127:f00f:0005:0000:0000:0000:0000

Remove additional AAAA records that point to other hosts or services, but keep the Shopify AAAA record.

Step 3: Check the WWW CNAME Record

Run:

dig +short www.yourstore.com CNAME

The result should point to:

shops.myshopify.com.

There should be only one CNAME record using the www hostname.

Step 4: Check DNSSEC, Proxying, and CAA Records

If the A, AAAA, and CNAME records are correct but the certificate is still pending, review these additional DNS settings:

• Deactivate DNSSEC for the domain.
• Remove unsupported third-party proxying from the Shopify-connected records.
• If you use CAA records, make sure they allow every certificate authority required by Shopify.

How to Fix Shopify SSL Pending

Fix 1: Configure the Required A, AAAA, and CNAME Records

Open your domain provider's DNS management panel and configure the Shopify records as follows:

Record Type	Host / Name	Value / Target
A	@	23.227.38.65 or the valid Shopify IPv4 address shown for your store
AAAA	@	2620:0127:f00f:5::
CNAME	www	shops.myshopify.com.

Warning: Do not delete MX or TXT records that are used for email, domain verification, or other services unless you know they are obsolete. Only remove records that conflict with the Shopify web-domain connection.

Fix 2: Remove Conflicting A and AAAA Records

Shopify's manual connection instructions require the root domain to use the Shopify A and AAAA records. Remove extra root A or AAAA records that point to previous web hosts, site builders, or unrelated servers.

Do not remove Shopify's required AAAA record. Older troubleshooting advice that recommends deleting all AAAA records is no longer correct for Shopify's current manual domain configuration.

Fix 3: Disable DNSSEC

If DNSSEC is active for the domain, deactivate it through your domain provider. Shopify's domain troubleshooting guidance lists active DNSSEC as a condition that can prevent a connected third-party domain from completing TLS provisioning.

1. Log in to your domain registrar or DNS provider.
2. Open the domain's DNS or security settings.
3. Locate DNSSEC.
4. Deactivate DNSSEC or remove the active DNSSEC configuration.
5. Save the change and allow time for DNS updates to propagate.

Fix 4: Review CAA Records

CAA records are optional for Shopify. However, if your domain uses CAA restrictions, the configuration must allow the certificate authorities Shopify uses for TLS certificate issuance.

Make sure your CAA configuration permits:

• letsencrypt.org
• pki.goog
• ssl.com

Shopify's secure-connections documentation also specifies the Google CAA value as pki.goog; cansignhttpexchanges=yes where that parameter is required by the DNS configuration. If you do not need CAA restrictions, removing conflicting CAA records is another supported troubleshooting option.

Fix 5: Remove Unsupported Third-Party Proxying

Shopify does not support third-party proxies for a standard third-party domain connection. If you manage DNS through a provider such as Cloudflare and the Shopify-connected record is proxied, follow Shopify's current domain troubleshooting guidance and your DNS provider's instructions to remove the unsupported proxy configuration.

If you use Cloudflare, this commonly means changing the relevant DNS record from Proxied to DNS only. Allow time for the DNS change to take effect before checking Shopify again.

Verifying the Fix

After correcting the DNS configuration:

1. Open Shopify Admin > Settings > Domains.
2. Select the affected domain and review the connection details Shopify displays.
3. Verify that the A, AAAA, and CNAME records match the required values.
4. Allow up to 48 hours for DNS propagation and TLS certificate provisioning.
5. Open your store using https:// and verify that the browser reports a secure connection.

When the certificate has been issued successfully, the domain should display a Connected status in Shopify and the storefront should load over HTTPS without a certificate warning.

When to Contact Support

If more than 48 hours have passed and SSL or TLS is still pending, verify the following before contacting support:

• The root A record points to Shopify's valid IPv4 address.
• The root AAAA record points to 2620:0127:f00f:5::.
• The www CNAME points to shops.myshopify.com.
• No conflicting A or AAAA records remain.
• DNSSEC is deactivated.
• Any CAA records allow all certificate authorities required by Shopify.
• No unsupported third-party proxy configuration is interfering with the domain connection.

If the public DNS records still do not match what you configured, contact your domain provider because Shopify cannot directly edit a third-party provider's DNS settings.

If the DNS records are correct and fully propagated but Shopify continues to show SSL Pending, TLS Pending, SSL Unavailable, or TLS Unavailable, contact Shopify Support for further investigation.

Frequently Asked Questions

How long does Shopify SSL Pending normally last?

Shopify states that TLS certificate issuance for a connected third-party domain can take up to 48 hours. A pending status during that period does not necessarily indicate a fault.

Should I delete the AAAA record to fix Shopify SSL Pending?

No. For Shopify's current manual third-party domain configuration, the root domain should have a Shopify AAAA record pointing to 2620:0127:f00f:5::. Remove only additional or conflicting AAAA records.

Can I upload my own SSL certificate to Shopify?

No. Shopify automatically provides TLS certificates for domains added to the platform and does not support using a third-party SSL certificate for the storefront.

Can CAA records cause SSL Pending?

Yes. If your domain uses restrictive CAA records and they do not permit the certificate authorities Shopify uses, certificate provisioning can fail. Shopify requires CAA access for Let's Encrypt, Google Trust Services, and SSL.com when CAA restrictions are present.

Sources & References

• Connect your third-party domain to Shopify manually - Shopify Help Center
• Enabling secure connections to your Shopify store - Shopify Help Center
• Troubleshoot issues with domains connected to Shopify - Shopify Help Center
• Considerations for using a third-party domain - Shopify Help Center

✓Built around verifiable troubleshooting

TechCorner HQ guides prioritize authoritative documentation, reversible diagnostics, safer fixes, and clear verification steps. See our review process and corrections policy.