How to Fix Your SSL Certificate on Shopify

Shopify handles SSL for you. The certificate is free, it is provisioned automatically when you connect a domain, and it renews itself. There is no button to press and nothing to pay.

So when an SSL check fails on a Shopify store, it is usually one of three things: the certificate has not finished provisioning yet, the domain is not connected properly, or the padlock is being broken by mixed content.

When you connect a domain, certificate provisioning can take up to 48 hours. During that window the store is genuinely not secured and any checker will say so, correctly.

If you connected your domain in the last day or two, this is very likely all that is happening. Wait it out before you change anything. Fiddling with DNS mid-provisioning is a good way to restart the clock.

Worth stating plainly, because people try. Shopify's position is direct: you can't use third-party SSL certificates.

So if you bought a certificate elsewhere, or your old host issued you one, there is nowhere to install it. That is not a limitation you can work around, and honestly it is not one worth wanting. The free certificate Shopify provisions does exactly the same job in a browser, and it renews without you remembering to.

This is the one that catches most stores. Your certificate is fine, HTTPS works, but the padlock is missing or the browser complains anyway.

The cause is mixed content: a secure page loading something over plain http://. An image, a script, a font, a tracking pixel. The page is encrypted, the thing it pulled in is not, and the browser treats the whole page as compromised. Scripts loaded over http are usually blocked outright, which is why a broken padlock is sometimes accompanied by a broken feature.

Where it hides on a Shopify store:

Open your store, open the browser console, and reload. Mixed content warnings name the exact URL causing the problem. Fix them by changing http:// to https:// wherever the URL is stored.

Avoid protocol-relative URLs like //example.com/thing.js. They were a reasonable trick years ago and are no longer recommended. Write the full https:// URL.

If you are setting a store up from scratch, sequence matters. Doing this out of order is how sites become unreachable.

Good news: at the time of writing, Shopify already sends an HSTS header on storefronts, so this is largely handled for you. There is nothing to add, and there is no way to add it anyway, as covered on our Shopify security headers page.

On preloading, our advice is to leave it alone. The HSTS preload list requires a max-age of at least a year plus includeSubDomains and preload, a valid certificate, an HTTP to HTTPS redirect on the same host, and every single subdomain on HTTPS. The catch is the exit: inclusion cannot easily be undone, and removal takes months to reach users via a Chrome update. That is a long time to live with a mistake on a store that takes payments.

Most stores never touch CAA records. If you do, they matter here, because a CAA record tells certificate authorities who is allowed to issue for your domain. Get it wrong and you block your own renewals.

Shopify issues certificates through letsencrypt.org, pki.goog and ssl.com. If you publish CAA records, all three need to be allowed, or a renewal can fail at the worst possible moment.

Some guides suggest proxying a Shopify store through your own Cloudflare account. Shopify says otherwise, in its own words: Cloudflare proxy setups, including O2O, are not supported by Shopify, might appear to work, could break at any time, and any resulting issues are outside the scope of Shopify Support. One of the reasons they cite is interference with the ACME challenge, which is exactly the mechanism that renews your certificate.

So a setup like this can silently break the very thing this page is about. We would not do it on a store that takes money.

Once the padlock is back, run a free check to confirm the certificate is valid and serving, and to see whether anything else on the page is still loading insecurely.