Enabling secure connections to your Shopify store

Enabling secure connections to your Shopify store ensures that the data that your customers enter remains private and secure. This is achieved using a TLS (Transport Layer Security) certificate, sometimes referred to as an SSL (Secure Sockets Layer) certificate, that encrypts communication between your store and external content, and publishes the content securely using HTTPS instead of HTTP.

For example, if your store's URL is http://www.example.com, then the URL is changed to https://www.example.com when the TLS certificate is issued. If your customers use the original URL, then they're redirected automatically to the encrypted online store.

TLS certificates have the following benefits for your online store:

They add a layer of security by encrypting customer data.
They help to build your customers' trust by displaying a padlock icon beside your online store's URL.

Acquiring a TLS certificate

TLS certificates are provided for free for all domains that are added to Shopify. A TLS certificate is issued automatically in the following circumstances:

For any assets that are hosted on the .myshopify.com domain.
When you buy a custom domain through Shopify or transfer a domain to Shopify.
When you connect your third-party domain to Shopify by changing your A record and CNAME record to point to Shopify. In this case, it might take up to 48 hours for the TLS certificate to be issued. During that time, a TLS or SSL pending might display in your Shopify admin domain settings. After 48 hours, if your TLS has failed, you might have a TLS or SSL unavailable message displayed in your Shopify admin domain settings. If you have an error message similar to Your connection is unsecure on your storefront after 48 hours, then try the troubleshooting steps. If those steps don't resolve the TLS issues, then contact Shopify Support.

You can make sure that your TLS certificate has been issued by verifying that the status of the domain is Connected on the Domains page. In addition, the padlock icon is displayed beside your online store's URL in the address bar when you view your storefront.

Verifying that your assets are secure

If your online store includes images, videos, webfonts, or other assets that are hosted somewhere other than on Shopify, then they should be delivered over HTTPS. Any page in your Shopify online store that includes an asset that isn't delivered over HTTPS is considered to be insecure.

The best option to ensure that your assets are secure is to host all your online store's assets on Shopify.

If you need to host your assets outside of Shopify, then make sure that you do the following:

Host your assets on a server that publishes over HTTPS. Learn more about uploading files to your Shopify admin.
Host your video content on a service that publishes over HTTPS.
When you use webfonts, verify that they're published over HTTPS from their source.

Certification Authority Authorization (CAA) records

A Certification Authority Authorization (CAA) record is used to specify which certificate authorities are allowed to issue certificates for a domain. A certificate authority (CA) is a trusted entity that issues electronic documents that verify a digital entity's identity on the Internet.

You don't need CAA records for your store. However, if you're required to use CAA records, then the following certificate authorities (CA) must be added to each CAA record at the same time that you connect your domain to Shopify:

Troubleshooting security errors for your third-party domain

If you experience TLS or SSL errors after connecting your domain, such as "SSL pending", "SSL unavailable", or "Your connection is unsecure" messages, then refer to Troubleshoot issues with domains for step-by-step resolution guidance including DNS verification, CAA record requirements, and DNSSEC considerations.