Webflow custom domain SSL expired

Webflow ssl certificate expired on your custom domain blocks the marketing site and embedded forms—even when the *.webflow.io staging domain still loads over HTTPS.

Webflow hosts static and CMS-backed sites on its CDN. SSL is tied to Hosting → Custom domains DNS verification, not to individual Designer publishes.

Confirm external openssl before you roll back CMS changes or blame Webflow forms spam filtering.

First response

In Project settings → Hosting → Custom domains, capture status icons (connected, SSL issuing, error). Note default yoursite.webflow.io URL for comparison.

Export DNS records Webflow requires (often A records to Webflow IPs and www CNAME to cdn.webflow.com or updated targets from the panel—always copy live values from your project).

Identify whether the domain uses Webflow as registrar or external DNS (GoDaddy, Route 53). List agency changes in the last 72 hours.

Export Client-First or custom code embeds that load scripts from your apex—those requests fail TLS independently of Designer canvas previews. Webflow ssl certificate expired during a product launch often correlates with half-migrated www only DNS.

What this error means

Webflow orders and renews certificates for domains correctly pointed at its hosting stack. Visitors validate whatever certificate the CDN returns for SNI matching www.yourbrand.com. Expired or missing certs yield standard browser date warnings.

Designer Publish pushes content to already-provisioned hosting; it does not replace broken DNS at your registrar. Webflow ssl certificate expired on a disconnected domain often means traffic still hits an old server certificate from previous hosting.

Enterprise reverse-proxy setups can terminate TLS off-Webflow; those teams must renew origin certs separately.

Common causes

Launched site on Webflow but left apex A record pointing at legacy WordPress infrastructure.

Removed Webflow verification CNAME when “simplifying DNS.” Multiple Webflow projects claim same domain across client accounts.

Partial migration: www on Webflow, apex on parked domain with expired default cert. IPv6 records forgotten during cutover.

CAA records block Let’s Encrypt after security audit. Using Cloudflare orange cloud with outdated origin SSL settings while Webflow thinks DNS is correct.

Webflow University staging links sometimes tempt teams to test on unconnected hostnames—keep incident scope to domains listed under Hosting. Reverse proxy setups on Enterprise must renew origin certs even when Webflow edge is healthy; marketers may still report “Webflow SSL” when the proxy expired.

Confirm from the outside

echo | openssl s_client -connect www.yourbrand.com:443 -servername www.yourbrand.com 2>/dev/null \
  | openssl x509 -noout -dates -subject -issuer -serial

dig +short www.yourbrand.com
dig +short yourbrand.com A

curl -vI --connect-timeout 15 https://www.yourbrand.com/ 2>&1 \
  | grep -Ei 'expire|SSL certificate|server:'

Compare staging:

echo | openssl s_client -connect yoursite.webflow.io:443 -servername yoursite.webflow.io 2>/dev/null \
  | openssl x509 -noout -dates -issuer

How to read the output

Non-Webflow IP in dig with expired cert confirms DNS fix first. Webflow-issued Let’s Encrypt chain with old notAfter while panel shows connected warrants support ticket with timestamps. Form action URLs hitting http:// after fix indicate mixed content, not ongoing expiry.

Browser spot-check

Compare desktop and mobile breakpoints on the same custom domain; both share one certificate, but service workers can cache failed TLS pages on one device only—hard refresh after fix.

Fix checklist

Work this list in order for Webflow ssl certificate expired. Designers should avoid republishing until Hosting shows a valid certificate badge.

1. Align DNS exactly to Hosting tab instructions for apex and www.
2. Remove conflicting records at registrar (old A, stray AAAA, duplicate CNAME).
3. Wait for global propagation; click refresh/reconnect in Webflow domain settings.
4. Republish site after domain shows connected with valid SSL badge.
5. Force HTTPS in Project settings → Hosting if available.
6. External openssl until serial updates.
7. Test forms, e-commerce (if Webflow Ecommerce), and password pages.
8. Document DNS owner for client handoff.

Roll out and verify

Republish after SSL is valid so asset URLs in CMS reflect https://. Test Webflow forms notification emails and Zapier webhooks—those integrations fail silently while Designers still preview on webflow.io.

For localization with hreflang subdirectories, curl each locale from external DNS. Client billing contacts should receive a one-line summary with new notAfter and confirmation that apex and www both pass.

Agencies: store a screenshot of Webflow Hosting DNS panel in the client folder; the next SSL scare should take minutes, not days of credential hunting.

When to use automation

Agency clients forget registrar logins until expiry. Schedule live TLS checks on every production custom domain, not only webflow.io preview links.

/check after DNS cutover. ssldays monitoring pairs TLS with RDAP so domain renewal lapses do not break the next Webflow validation.

Client staging on webflow.io should not mask missing production TLS—monitor custom domains explicitly. Form endpoints and Zapier hooks belong on the same watch list as marketing landing pages. Agencies maintaining dozens of Webflow sites benefit from hourly checks on high-traffic retail domains.

See Squarespace SSL certificate issues and Shopify SSL certificate errors when commerce embeds cross platforms.

Webflow Ecommerce sites may use separate Stripe domains or Apple Pay verification hosts—confirm those labels on certificates when checkout fails after a partial DNS fix. Universities and nonprofits run campaign microsites on subdomains delegated to Webflow; parent org DNS may still point apex at legacy WordPress with expired TLS, mimicking “Webflow SSL broken.”

Localization workflows with hreflang subfolders need each hostname on the certificate or dedicated connections per locale. Client legal teams sometimes demand HSTS headers enabled before verifying custom domain TLS—enable strict transport only after external openssl passes on all marketed URLs.

Agency closures for webflow ssl certificate expired require client-visible proof: openssl on the live custom domain after republish, plus a form submission test email. Designer canvas uses webflow.io TLS—never substitute that for customer domain validation. Store Hosting DNS screenshots in the client CRM so the next SSL scare resolves in one change window.

Client communication templates for Webflow agencies should explain that Designer preview uses a different hostname than the customer custom domain, so a green padlock in the editor does not prove production TLS health. Legal review sometimes demands forcing HTTPS sitewide before certificates validate; resist that sequencing because browsers will show hard errors instead of gentle redirects.

Enterprise reverse proxy arrangements need a written statement of who renews which layer when marketing attributes all SSL to Webflow branding. Universities with dozens of department microsites should maintain a spreadsheet of which subsite uses Webflow Hosting versus embedded iframes on other platforms, because TLS responsibility follows DNS answers, not brand guidelines.

Paid media teams should receive an all clear only after external verification on every URL printed in live creatives. Form spam tools and bot protection vendors may still flag recovered sites until their caches refresh; note that secondary delay when communicating with clients. Real estate listing clients syndicating MLS feeds rely on timed drip campaigns; pause drips until every property landing hostname on Webflow passes external verification, not only the brokerage homepage. Architecture portfolios with heavy video assets still need TLS on the HTML shell serving those embeds. Award submission deadlines with live project URLs are common failure drivers; agencies should verify TLS seventy two hours before jurors open shortlists. Municipal clients publishing planning notices with mandatory public comment links need clerks to confirm those links negotiate trusted HTTPS before council meetings. Design awards microsites migrated from Behance links should not go live until Webflow Hosting DNS and external certificate checks both pass repeatedly over twenty four hours. Museum exhibitions publishing artist pages on Webflow should coordinate opening night announcements with TLS verification on ticket purchase URLs. Boutique hotels promoting seasonal packages should test booking paths on guest phones before billboards go live. Architecture firms submitting competition entries should attach external TLS proof when URLs are part of the deliverable. Developer portfolio grids linking to client sites should note which hostnames they do not operate. Client kickoff decks should record the registrar login and Webflow workspace owner in one place. Handoff PDFs should include the last successful external TLS check date. Retainer clients should receive quarterly TLS status notes in reporting emails. Campaign retrospectives should list certificate incidents beside creative metrics. Account managers should store DNS vendor contacts next to Webflow invite emails.