How to fix ssl cert invalid on Shopify
Install a valid SSL/TLS certificate that exactly matches your store's domain name, so browsers trust your site and customer data is encrypted in transit.
Steps for Shopify
- Shopify provisions and manages SSL certificates automatically for all stores on the myshopify.com subdomain and for connected custom domains.
- Go to Admin → Settings → Domains. Verify your custom domain is listed and shows a green padlock / 'SSL available' status.
- If it shows 'SSL unavailable' or a pending state, remove the domain and re-add it: click the domain name → Remove domain, then re-add it using 'Connect existing domain'. Shopify will re-provision the certificate within minutes to hours.
- Ensure your domain's DNS A record points to Shopify's IP (23.227.38.65) and the CNAME for www points to shops.myshopify.com — a misconfigured DNS record is the most common cause of Shopify SSL failures.
- If the certificate is still not provisioning after 48 hours, contact Shopify Support. Shopify does not allow you to upload a custom certificate on standard plans.
What is ssl cert invalid?
Every website served over HTTPS needs an SSL/TLS certificate issued by a trusted Certificate Authority (CA). That certificate must list the exact domain name (or a wildcard that covers it) your visitors use to reach your store. A "hostname mismatch" error means the certificate installed on your server was issued for a *different* domain — for example, it covers `www.example.com` but your store is accessed at `example.com`, or the certificate belongs to a completely different domain altogether. Browsers check this match every time someone loads your site; if it fails, they show a full-screen warning and refuse to complete the connection.
A certificate hostname mismatch is one of the most damaging trust failures an online store can have. Browsers (Chrome, Firefox, Safari, Edge) display a red "Your connection is not private" warning that blocks visitors before they ever see your store — most users immediately leave and never return, costing you sales directly. Google treats HTTPS as a ranking signal and may demote or de-index pages that cannot be loaded securely, reducing your organic traffic. From a legal and compliance perspective, payment card industry (PCI-DSS) rules require that cardholder data be encrypted with a valid certificate; a mismatch means you are technically non-compliant and could face fines or lose the ability to accept cards. Under OWASP's A02:2021 Cryptographic Failures, an invalid certificate is classified as a critical security vulnerability because it leaves all data exchanged between your customers and your store potentially exposed to interception.
See the complete Ssl cert invalid guide for every platform and the full background.
Not sure if your Shopify store has this?
Run a free SEOLZ audit — we’ll find ssl cert invalid and every other issue across your whole site.
Scan my site free