How to fix ssl error on Squarespace
Replace or reissue your SSL/TLS certificate so it is valid for the exact domain name your store uses, eliminating the hostname mismatch error.
Steps for Squarespace
- Squarespace automatically provisions free SSL certificates (via Let's Encrypt) for all sites, including custom domains.
- Go to: Squarespace Admin → Settings → Domains (or Website → Pages → Website Tools on older navigation).
- Click your custom domain and confirm it is 'Active' with SSL enabled.
- If SSL shows as unavailable, the most common cause is incorrect DNS — ensure your domain's CNAME record points to ext-cust.squarespace.com (for subdomains/www) and/or the A record is pointed to Squarespace's correct IP.
- Toggle 'HTTPS Encryption' on under Settings → Advanced → SSL if it appears disabled.
- Allow up to 72 hours after DNS correction for the certificate to be issued. Contact Squarespace Support if the issue persists.
What is ssl error?
Every HTTPS website uses an SSL/TLS certificate to prove its identity to browsers and to encrypt the connection. The certificate must explicitly list the domain name (or names) it is allowed to protect. A "hostname mismatch" error means the certificate installed on your server was issued for a different domain than the one visitors are actually trying to reach — for example, the certificate covers "www.yourstore.com" but not "yourstore.com" (or vice versa), or it was issued for a completely different domain altogether. Browsers and security scanners treat this as a critical failure and refuse to establish a trusted connection.
When a hostname mismatch exists, most modern browsers display a full-page "Your connection is not private" warning before visitors can even see your store. This kills conversions — the majority of shoppers will leave immediately rather than click through a security warning. Google also uses HTTPS as a ranking signal and can demote or omit pages it cannot crawl securely. Beyond lost sales and rankings, transmitting payment and personal data over an untrusted connection is a serious security risk and may violate PCI DSS compliance requirements for accepting card payments. This maps directly to OWASP A02:2021 — Cryptographic Failures.
See the complete Ssl error guide for every platform and the full background.
Not sure if your Squarespace store has this?
Run a free SEOLZ audit — we’ll find ssl error and every other issue across your whole site.
Scan my site free