HowToCodePage

Custom domains and TLS

Pointing a domain at your host, choosing between apex and www, and getting certificates that renew themselves.

Pointing the domain

Hosting providers give you either an IP address or a hostname to point at. Use an A/AAAA record for an IP, and a CNAME when the provider manages a pool of addresses behind their own name - that is far more robust, but a CNAME is not allowed at the apex, which is why apex support needs provider-side flattening or an ALIAS record.

; recommended shape: www is the CNAME, apex redirects to it
example.com.   300  IN  A      203.0.113.10      ; or ALIAS to host.example.net
www.example.com. 300 IN  CNAME  host.example.net.

; alternative: both served, one canonical
example.com.   300  IN  A      203.0.113.10
www.example.com. 300 IN  A     203.0.113.10
  • Pick one canonical hostname and redirect the other with a single 301 - no chains.
  • Add the custom domain in the hosting panel too, or the request arrives at the edge with an unknown host header.
  • Remove the provider's default domain from the sitemap and canonical tags; it should redirect or 404, not compete.
  • Verify with the host header before the DNS change is global: curl -H "Host: example.com" https://203.0.113.10/ -kI.

Certificates that renew themselves

Modern hosts issue and renew certificates for you once the domain resolves correctly. If you manage TLS yourself, automate issuance and put a monitoring check on the expiry date - an expired certificate is still one of the most common self-inflicted outages.

# is the chain complete, and when does it expire?
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates

# does the www variant work too?
echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null \
  | openssl x509 -noout -subject
CertificateCoversWatch out for
Single nameexample.comDoes not cover www - a common padlock warning
SAN listEach name listedAdd every subdomain you actually serve
Wildcard*.example.comNever covers the bare apex; include both
Managed by the platformEvery configured domainFails silently if DNS points elsewhere

Redirect HTTP to HTTPS at the edge or in the server block, then send Strict-Transport-Security so browsers stop trying plain HTTP at all.

Launch checklist

  1. Both hostnames resolve, and one redirects to the other with a 301.
  2. TLS is valid on every hostname you serve, with a complete chain.
  3. The canonical URL in your pages, sitemap and feeds matches the live hostname.
  4. HTTP redirects to HTTPS, and HSTS is enabled once you are certain.
  5. A 404 for a missing path returns 404 - not the homepage with a 200 status.
💡
Test the redirect direction from the outside, not from your machine. A local hosts-file entry or a cached HSTS decision can make a broken redirect look perfectly normal.

FAQ

Apex or www?
Either, as long as the other redirects permanently. Apex reads better; www is easier to move between providers because it can be a CNAME.
Why does my certificate look invalid on www?
The certificate only lists the bare domain. Reissue with both names (or a SAN list including both) and make sure the www hostname is added to the platform.

Static versus dynamic hosting HTTPS and TLS

Last refreshed 2026-09-18.