How SSL Certificates Work on UniLink (Automatic HTTPS for Your Custom Domain)

UniLink automatically provisions and renews SSL certificates for custom domains — here's what happens behind the scenes, how long it takes, and what to do if HTTPS isn't working.

HTTPS is no longer optional. Browsers flag HTTP sites as "Not Secure," search engines rank HTTPS pages higher, and visitors are increasingly likely to leave a site that shows a security warning. UniLink handles SSL entirely on your behalf — once your custom domain is connected and DNS is verified, a certificate is issued automatically with no configuration on your part. This article explains how that process works, what to expect at each stage, and how to resolve the most common HTTPS issues.

What Automatic SSL Does

UniLink uses Let's Encrypt, a free, automated, and open certificate authority trusted by all major browsers. When you connect a custom domain, UniLink requests a certificate from Let's Encrypt for your domain. Let's Encrypt verifies that you actually control the domain by checking that it resolves to UniLink's servers — this is why DNS must propagate before SSL can work.

Once issued, the certificate is installed on UniLink's servers automatically. All traffic to your custom domain is served over HTTPS, and any HTTP requests are redirected to HTTPS. The certificate is valid for 90 days but renews automatically before it expires. You will never receive a "certificate expired" warning on a domain that stays connected to UniLink.

This process is completely hands-off. You do not need to purchase a certificate, install anything, or configure any server settings. The only prerequisite is that your DNS records point to UniLink and have propagated globally.

How to Get Started With SSL on Your Custom Domain

1. Connect your custom domain — In your UniLink dashboard, go to Settings → Custom Domain, enter your domain name, and save. UniLink will show you the DNS records you need to create.
2. Add the correct DNS records — At your domain registrar, create the CNAME or A record as shown in your dashboard. For SSL to work, your domain must resolve to UniLink's servers. See our DNS configuration guide for provider-specific instructions.
3. Wait for DNS propagation — SSL provisioning starts automatically once UniLink detects your DNS records. Propagation typically takes 15–60 minutes. You can track it at dnschecker.org.
4. Watch for the "Active" status — In Dashboard → Settings → Custom Domain, the domain status changes to "Active" once DNS is verified and the SSL certificate has been issued. This usually happens 5–15 minutes after DNS propagates.
5. Test your HTTPS connection — Open your custom domain in a browser. You should see a padlock icon in the address bar. Click the padlock to confirm the certificate is valid and issued to your domain.
6. Check for mixed content warnings — If the padlock shows a warning triangle, you likely have mixed content (HTTP resources loaded on an HTTPS page). Check your page for any HTTP image URLs or embeds and update them to HTTPS.
7. No renewal needed — Your certificate renews automatically 30 days before expiry. No action required on your part.

How to Diagnose SSL Issues

1. Confirm DNS propagation first — SSL cannot be issued if DNS hasn't propagated. Go to dnschecker.org and enter your domain. You need to see green checkmarks from most locations before SSL can provision.
2. Check the certificate details in your browser — Click the padlock (or the "Not Secure" warning) in your browser's address bar → Connection is secure → Certificate is valid. Look at the "Issued to" field. It should show your domain name, not a default UniLink domain.
3. Look for mixed content errors — Open your browser's developer tools (F12), go to the Console tab, and reload your page. Mixed content errors appear as warnings like "Mixed Content: The page at 'https://...' was loaded over HTTPS, but requested an insecure resource 'http://...'."
4. Test with SSL Labs — Go to ssllabs.com/ssltest and enter your domain. It gives a detailed report including certificate validity, expiry date, and any configuration problems.
5. Check Cloudflare proxy status — If your domain is managed by Cloudflare and the proxy (orange cloud) is enabled, Cloudflare serves its own certificate, not UniLink's. This can cause SSL errors. For UniLink to issue its own certificate, set the DNS record to DNS Only.
6. Wait up to 30 minutes after DNS propagation — The certificate provisioning process itself takes a few minutes after DNS verifies. If the domain just became active, give it another 15–30 minutes before troubleshooting further.
7. Contact support if certificate never issues — If your domain has been showing correct DNS records for more than 2 hours and SSL still hasn't provisioned, contact UniLink support with your domain name and a screenshot of your DNS records.

Key Settings Explained

How to Get the Most Out of SSL on UniLink

The automatic SSL setup covers everything for a standard custom domain connection. However, there are a few things worth understanding to avoid confusion down the road. The most common point of confusion is the difference between a full padlock and a padlock with a warning. A full padlock means HTTPS is working perfectly. A padlock with a warning triangle means HTTPS is active but some resources on the page are loading over HTTP — this is mixed content and while it doesn't break security entirely, browsers flag it and it looks unprofessional.

Mixed content most commonly comes from image blocks where you've pasted an HTTP image URL, custom HTML blocks with embedded content, or third-party widgets that still use HTTP endpoints. The fix is straightforward: find the HTTP resource and update its URL to use HTTPS. If the resource only exists over HTTP and cannot be changed, consider hosting it on a CDN that supports HTTPS.

Another thing to know is that SSL works per domain. If you later add a second custom domain to your UniLink account, the certificate provisioning process starts fresh for that domain. Each domain gets its own certificate, issued and renewed independently. There's no shared certificate or wildcard needed on your part.

Finally, if you ever disconnect a custom domain from UniLink (for example, to move to a different platform), your SSL certificate will no longer renew and will expire within 90 days. The domain's security then depends entirely on wherever you point DNS next. UniLink's certificate is tied to UniLink's infrastructure, not to the domain itself.

Troubleshooting Common Issues