EStore Tools

Shopify SSL Pending Diagnoser

Find the CAA, AAAA, proxy or DNS record holding up your Shopify SSL certificate.

Describe the result you need. AI will set up the tool and ask for any missing details.

Configure with AI

Enter to submit · Shift + Enter for a new line

Sent to AI. Leave out passwords and private customer data.

The four usual causes

  • A Cloudflare (or other) proxy in front of the domain. Shopify doesn't support any proxy; a proxied record can serve the site while permanently blocking the certificate.
  • CAA records that don't list letsencrypt.org, pki.goog or ssl.com, Shopify's certificate authorities.
  • A missing or wrong AAAA record. Let's Encrypt checks IPv6 first when a AAAA record exists and points elsewhere, which can stall issuance even while the site loads fine over IPv4.
  • DNS that hasn't fully spread yet. Give a fresh change up to 48 hours before assuming it's stuck.

Fixing it

Run the checker with your domain. It reads your A, AAAA and CAA records over public DNS, flags whichever one doesn't match what Shopify expects, and gives you CAA records to paste in if that's the blocker.

If everything checks out here but the admin still shows pending, it's usually just time: give it up to 48 hours, then contact Shopify support.

Questions people ask

My site loads fine, so why is SSL pending?

A domain can resolve and even load the storefront through a proxy or an old host while its A/AAAA/CAA records still fail Shopify's certificate checks. Loading is not the same as passing certificate issuance.

I use Cloudflare. Do I have to turn off the proxy?

For the Shopify records specifically, yes: set them to DNS only (grey cloud). You can keep other subdomains proxied.

What's a CAA record and why would I even have one?

It restricts which certificate authorities may issue certificates for your domain. Some registrars add one by default, or a previous host may have set one that only allows its own CA.

How long is normal before SSL issues?

Often within a few hours of the records being correct. Shopify's own guidance allows up to 48 hours for DNS changes to fully spread first.

Related tools

Shopify DNS Setup GeneratorPick your DNS host and get the exact records to add and delete to connect your domain to Shopify, without breaking email.Shopify Domain Connection CheckerEnter your domain to see which DNS record is stopping it connecting to Shopify, and get the exact records to fix it.Klaviyo Sending Domain CheckerCheck whether your Klaviyo branded sending domain's DKIM is live, plus SPF and DMARC, in one DNS lookup.DMARC Record GeneratorBuild a DMARC TXT record with presets for Shopify Email, Klaviyo and Google Workspace.

Want this builtinto your store?

I'm Emmanuel, a Shopify and WooCommerce developer. If this tool pointed at something you'd rather have fixed for you (a faster store, cleaner product data, a migration, a custom feature), send me a note.

Emmanuel Asika

Emmanuel Asika

Shopify & WooCommerce developer, Dublin

I build and fix online stores: new builds, migrations, speed, SEO and the custom bits apps can't do.

hello@emmanuelasika.com
See my work

Last reviewed 30 September 2026.

Sources: Shopify Help: Connecting a third-party domain manually · Shopify Help: Troubleshooting domains connected to Shopify · Shopify Help: Enabling secure connections (CAA records) · Cloudflare: IP ranges · Cloudflare: Proxy status · Let's Encrypt: IPv6 support