Squarespace SSL certificate issues

Squarespace ssl certificate expired (or stuck provisioning) means visitors cannot load your custom domain—even though yoursite.squarespace.com may still answer over HTTPS.

Squarespace issues and renews certificates for domains connected inside the site settings. DNS that points at old hosting or conflicting MX/TXT records can stall renewal until the edge serves an expired or mismatched cert.

Always openssl the custom domain from outside Squarespace’s editor preview.

First response

In Settings → Domains, list each custom domain status: Connected, Pending, or Invalid configuration. Expand DNS requirements and screenshot Squarespace’s expected records.

Test yoursite.squarespace.com versus www.yourbrand.com. Note if you recently transferred registration to Squarespace Domains or still use external DNS.

Capture email from Squarespace about SSL failure. Export any third-party services (Google Workspace verification, Zoho) that required TXT records—accidental deletion breaks validation paths.

If the site uses Squarespace scheduling or member areas, collect the exact subdomain Squarespace issued for those products—sometimes squarespace ssl certificate expired reports reference secure variants not visible in the main domain list.

What this error means

Squarespace terminates TLS on its infrastructure for connected domains. Browsers validate the certificate Squarespace’s CDN presents for SNI matching your domain. Expiry or failed revalidation surfaces as standard date errors, not CMS template bugs.

Connecting a domain only in the registrar without adding it under Settings → Domains leaves traffic hitting a previous host’s expired certificate—commonly reported as Squarespace SSL broken. True platform issues show Connected status with openssl notAfter in the past on the Squarespace IP range.

Common causes

A records still point to prior WordPress host while CNAME www points to Squarespace—apex serves expired legacy TLS.

Domain forwarders or parking pages at registrar intercept HTTPS. IPv6 AAAA records aimed at old servers split traffic.

Moving DNS to Cloudflare “Full” with an expired origin Squarespace cannot fix when misconfigured reverse proxy mode is used incorrectly.

Multiple Squarespace sites attempting to attach the same apex domain block certificate issuance. Propagation delays after DNS edits exceed patience; operators republish conflicting records.

Acuity or scheduling embeds on external blogs still point readers to Squarespace-hosted paths that need their own valid TLS. Donation forms embedded on third-party sites load iframe resources from your domain—those break when custom domain certs lapse even if the builder preview works.

Confirm from the outside

echo | openssl s_client -connect www.yourbrand.com:443 -servername www.yourbrand.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

dig +short www.yourbrand.com A
dig +short yourbrand.com A

curl -vI --connect-timeout 15 https://www.yourbrand.com/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|server:'

Compare issuer to Squarespace default:

echo | openssl s_client -connect yoursitename.squarespace.com:443 \
  -servername yoursitename.squarespace.com 2>/dev/null | openssl x509 -noout -issuer -dates

How to read the output

If openssl connects to non-Squarespace issuer or IP, DNS is wrong—not an automatic platform renewal bug. Matching issuer with expired dates while domain shows Connected warrants Squarespace support with openssl transcript.

Browser spot-check

Instagram and Facebook in-app browsers cache TLS failures aggressively—test in Safari/Chrome directly, not only inside social apps.

Fix checklist

Work this list in order for Squarespace SSL certificate issues. Save Squarespace domain screenshots before and after DNS edits for agency accountability.

1. Settings → Domains → your domain → DNS Settings—align A/CNAME/ALIAS exactly as listed.
2. Remove old hosting A records and stray AAAA records at registrar.
3. Wait for propagation (use global DNS checker), then click refresh/reconnect in domain panel.
4. Ensure domain is primary if using multiple; detach unused attachments.
5. Disable conflicting CAA records that block Squarespace’s CA if present.
6. Re-test openssl on apex and www.
7. Verify checkout links, embedded commerce blocks, and password-protected areas.
8. Keep documentation of who owns DNS after agency handoff.

Roll out and verify

Walk member areas, donation blocks, and scheduling widgets after TLS recovery—Squarespace embeds sometimes cache http:// script references in Custom Code injections. Re-publish pages only after domain status is green; publishing during DNS flapping can lengthen incidents.

Compare Squarespace Commerce test mode checkout against production domain. Marketing teams often run ads to www while email links use apex—validate both in openssl and in actual campaigns.

If you use G Suite verification TXT at the registrar, confirm those records survived the SSL fix; accidental deletion can break email deliverability the same week.

When to use automation

Squarespace does not expose cert PEMs to merchants. Live TLS monitoring on each connected custom domain catches expiry or regression after DNS changes agencies make without telling marketing.

Run /check after every domain connect or registrar transfer. ssldays RDAP pairing warns before registration lapse breaks the next validation cycle.

Squarespace does not expose PEM files—external monitoring is mandatory for connected custom domains. Include scheduling and commerce checkout URLs in the watch list, not only the homepage hero. Agencies should monitor client domains in a central tool because Squarespace emails go to one login.

See Wix SSL certificate expired and Webflow custom domain SSL expired for similar hosted-builder DNS traps.

Squarespace creators often embed third-party checkout or donation iframes that load from custom domains outside Squarespace—those properties need separate TLS monitoring. Photographer portfolios with client proofing galleries may use password-protected URLs emailed to customers; expired TLS on the main domain blocks those campaigns without affecting the builder login.

Transferring a domain from Squarespace Domains to an external registrar without updating Settings → Domains disconnects hosting while DNS still partially points at Squarespace—openssl may show expired or mismatched material until connection is rebuilt. Wedding and event sites spike traffic on single weekends; schedule DNS changes mid-week when possible.

Resolve squarespace ssl certificate expired only when both apex and www show valid dates to external openssl—Squarespace campaigns often split traffic. Capture dig from multiple resolvers in the ticket; flaky fixes that work on the designer’s ISP fail globally until TTL expires. If email or Workspace TXT was touched during DNS cleanup, verify mail still flows before closing.

Creative agencies should store Squarespace login credentials and registrar credentials in the same vault entry so SSL incidents do not stall waiting for the photographer who originally connected the domain five years ago. Influencer campaigns amplify certificate warnings when thousands of followers tap short links simultaneously, making speedy DNS correction a brand issue rather than a technical footnote.

Squarespace commerce, scheduling, and members areas all depend on the same connected domain certificate for customer trust. Marketing may report only one product failing when the entire hostname is invalid for all paths. Teach clients to distinguish registrar billing renewal from TLS certificate renewal; both can break HTTPS within the same month if ignored.

Partners running email nurture sequences should pause sends until landing pages load without warnings, because mailbox providers penalize suspicious links that fail TLS. Portfolio sites with multiple custom domains attached over years benefit from an annual audit that removes unused connections. Music and video performers streaming concert tickets through Squarespace should test mobile wallet flows after TLS recovery because venue WiFi often caches failures differently from home broadband. Donation campaigns tied to nonprofit galas need treasurer sign off only after treasurer devices can complete a test gift without warnings. Alumni magazines printing QR codes months ahead should store the exact URL tested at print time so volunteers know which hostname must stay valid through fulfillment. Couples sharing wedding RSVP links on printed invitations need the same hostname monitored until the event passes, not only until the site launches. Food bloggers syndicating recipes to Squarespace from legacy Blogger redirects should confirm intermediate hostnames still negotiate trusted HTTPS for search crawlers. Podcast show notes linking to episode landing pages should wait for TLS recovery before publishing new episodes to aggregators. Yoga studios emailing class schedules should link only to hostnames verified the morning of send. Fashion lookbooks emailed to wholesale buyers should use the same custom domain hostname confirmed in external TLS checks that week. Interior designers sharing client galleries should delay password emails until custom domain TLS passes twice from two ISPs. Photographers delivering online proofs should test client login URLs on tablets before gallery notifications send. Workshop organizers posting registration links in event apps should confirm TLS on venue WiFi first. Gallery openings should delay press pitches until the custom domain passes external checks twice.