You connect a custom domain, Shopify says it is connected, but the domain remains on SSL Pending or customers see a connection-not-private warning. Waiting is appropriate at first, but after the normal provisioning window, the problem usually points to DNS or certificate issuance.
The real symptom
- Settings > Domains shows SSL or TLS pending.
- The root domain works but
wwwdoes not, or the reverse. - The browser reports that the connection is not private.
- The domain redirects repeatedly.
- The domain has remained pending for more than 48 hours.
The likely cause
Shopify must verify the domain and issue a TLS certificate after the domain points to Shopify. When it does not complete, common causes include incorrect A, AAAA, or CNAME records; restrictive CAA records; DNSSEC; an active proxy; conflicting records; or a certificate that needs Shopify Support to reset provisioning.
The confirmed Community fix
Community cases with correct-looking DNS commonly resolve in one of two ways: correcting the DNS configuration and waiting for propagation, or contacting Shopify Support after 48 hours so the certificate can be reprovisioned.
Start in Shopify admin
- Go to Settings > Domains.
- Click the affected domain.
- Review Shopify’s connection status and any displayed DNS requirements.
- Confirm which domain is primary.
- Check both the root domain and the
wwwsubdomain.
Check DNS, CAA, and DNSSEC
- Use the exact A and CNAME records Shopify displays.
- Remove conflicting A or AAAA records for the same host unless Shopify requires them.
- Set storefront records to DNS-only while provisioning if a proxy service is active.
- Review restrictive CAA records with the domain provider.
- Check DNSSEC for broken delegation.
Useful DNS checks
dig example.com A
dig www.example.com CNAME
dig example.com CAA
dig example.com DNSKEY