HCode gets the HTTPS certificate for every domain on your projects. You don't upload certificates or renew anything by hand, and there is nothing to switch on.
Generated addresses
Your project's hcode.site address is covered at HCode's edge from the moment the project exists. Its certificate step reads "The security certificate for this address is handled at our edge." See Your generated address.
Custom domains
When you add a domain, the dialog says "We'll set up HTTPS for it automatically once your DNS points to us." The certificate is requested once:
- your CNAME record points to
connect.hcode.site(the "DNS record" step), and - the first time, every name server for your domain has that record (the "Name servers" step), so a certificate request isn't answered with an old record.
HCode then connects the domain to your app and checks HTTPS. While it waits, the badge reads "HTTPS provisioning". When the certificate is in place, the "Security certificate" step says "Your domain has a valid security certificate.", the "HTTPS" step says "Your site works over HTTPS." and the badge moves to "Ready" with the note "HTTPS active" (or to "Serving" while the last checks finish).
When the certificate is slow
If your domain points straight at HCode but has no valid certificate yet, the wait is on HCode's side and the message says so: "This one is on us: it's on its way, and if it doesn't arrive soon we'll ask for a new one automatically. There's nothing you need to do."
HCode asks for a new certificate on a fixed schedule, counted from when the domain started waiting:
| Try | After |
|---|---|
| 1 | 5 minutes |
| 2 | 20 minutes |
| 3 | 1 hour |
| 4 | 2 hours |
| 5 | 4 hours |
| 6 | 8 hours |
| 7 | 16 hours |
| Then | once a day |
The "Security certificate" step shows "Next automatic try: after" followed by the time in your own time zone. A try goes out after that time, not exactly at it.
Check now re-runs the checks, so you see a certificate the moment it arrives, but it doesn't make the next try come sooner.
If a domain is still waiting after 2.5 hours, HCode's team is told about it and the message changes to say "our team has been told". The tries carry on.
The wait only counts while it's HCode's to fix. It stops if your DNS no longer points to HCode, if a CDN or proxy is in front of the domain, or if the project isn't running, and starts again once that's fixed. For a stopped app the message ends "We'll ask for a new one once your app is running again."
Certificate messages
When the certificate step finds a problem on a domain that points straight at HCode, it opens with one of these sentences. HCode keeps trying on the schedule above in each case, so none of them needs anything from you:
| Message | What it means |
|---|---|
| "Your domain points to us correctly, but its security certificate isn't ready yet (the server is still using a temporary certificate)." | The certificate hasn't arrived yet. |
| "Your domain points to us correctly, but its security certificate isn't ready yet." | The same, without the temporary certificate detail. |
| "Your domain points to us correctly, but its security certificate has expired." | A certificate is in place but out of date. |
| "Your domain points to us correctly, but its security certificate isn't valid yet (its start date is in the future)." | A certificate is in place but not valid yet. |
| "Your domain points to us correctly, but the security certificate it serves is for a different name." | The certificate doesn't cover this hostname. |
| "Your domain points to us correctly, but its security certificate isn't from an issuer browsers trust." | The certificate isn't trusted. |
Two other messages need you:
- "Your domain has a DNS record pointing at a private or reserved address, which we won't connect to. Remove that record and we'll check again automatically." Delete the record that points to an internal address such as
10.0.0.5or127.0.0.1. - "We couldn't reach your site over HTTPS yet. We'll keep checking automatically. There's nothing you need to do." HCode connected the domain but your site didn't answer over HTTPS. If it doesn't clear, check that the app is running. See App won't start.
Behind your own CDN or proxy
If your record is proxied (a CDN, a proxy, or your DNS provider's proxied setting), visitors get the certificate of whatever sits in front of HCode, not one from HCode. The domain shows "CDN or proxy detected", and HCode makes no certificate tries of its own. Until the proxy serves valid HTTPS, the note reads "CDN or proxy detected. Waiting for public HTTPS."
Problems are then yours to fix in the proxy's settings, and the messages say so:
- "We couldn't reach your site over HTTPS through what's in front of your domain (a CDN, a proxy, or your DNS provider's proxied setting) yet. Check that it serves HTTPS for this domain; we'll keep checking automatically."
- "Your domain reaches us, but the security certificate served by what's in front of it (a CDN, a proxy, or your DNS provider's proxied setting) has expired. Fix the certificate in that service's settings; we'll check again automatically." The ending changes with the problem: "is missing", "is a temporary self-signed one", "isn't valid yet", "is for a different name" or "isn't from an issuer browsers trust".
Once the proxy serves valid HTTPS, the note reads "HTTPS active through your CDN or proxy". If you didn't mean to put a proxy in front, switch the record to DNS only at your provider and HCode issues the certificate itself.
For the other check steps, see DNS troubleshooting.