Guides5 min read
Pointing a domain at your server, and the certificate that follows
Two DNS records, one proxy slot, and a certificate that renews itself. What each step is doing and where it usually goes wrong.
Every plan here carries a reverse-proxy slot, which is the thing that lets people reach your application by name instead of by address and port. The certificate is issued and renewed for you once the name resolves.
The DNS part
- 1.Add an A record for your domain pointing at the address in the Domain tab.
- 2.Add a second one for www if you want it to work too.
- 3.Wait. DNS is cached, and the wait is the part nobody believes.
Why the certificate failed
Certificate issuance checks that the name really points here, so it fails for exactly one reason in almost every case: the DNS has not propagated yet, or it points somewhere else. If you moved the domain from another host, the old record is often still cached - and a certificate cannot be issued for a name that resolves to somebody else's server.
- Check the record resolves to the address in the Domain tab, from outside your own network.
- If the domain sits behind a CDN, the origin must still be reachable for issuance.
- Renewal is automatic and happens inside the last 21 days - there is nothing to do annually.