How do I set up a SSL for my custom domain?

[capsci]

I have a store setup at store.example.com. The storefront uses a CNAME to point to  squareup.com/store/examplestore

One of my visitor's pointed out that I don't have an SSL certificate for checkout. Is there a way to fix that, or am I stuck?

[#2]

I hope I can help clarify @Vivosity!

Because your custom domain is owned by another company, the SSL certificate can't be added by Square onto their domain.

However, rest assured when your customer adds items to the cart and go to the checkout screen, they will still be redirected to https://squareup.comdomain with SSL during the checkout flow.

There definitely seems to be some confusion about when to use Let's Encrypt. I checked on this for you and at this time Let's Encrypt is only used by developers using Square's Transaction API. Developers can refer to this TLS and HTTPS technical documentation for more information. I've updated the post above too to reflect this. Thanks for bringing it to my attention!

[Tom · Accepted solution]

Thanks for your post, @capsci, and welcome to the Seller Community! 💯

At this time we do not provide SSL certificates but you can get one through Let’s Encrypt for free. Hope this helps get you in the right direction.

Update: Let's Encrypt can be used with Square's Transaction API, it cannot be used with Square's Online Store.

[Vivosity]

I have a custom domain and pointed it's CNAME at store.squareup.com. However, if I type "www.SITENAME.com" for example, it will fail at Square with the URL "httpS://www.SITENAME.com". If I enter "http://www.SITENAME.com", it will succeed. Where is the security being added (http vs https)? Can I fix this by getting a security certificate for SITENAME.com?

When I visit Let's Encrypt, they suggest that a certificate needs to be installed at Squareup. The L.E. support includes an support exchange from 21 days ago that indicates that Square does not actually enable using a Let's Encrypt certificate, even if you got it, because there's no interface to install it.

So how do we really get a custom domain to work without having to tell all shoppers to type the full http://...?

[Helen]

I hope I can help clarify @Vivosity!

Because your custom domain is owned by another company, the SSL certificate can't be added by Square onto their domain.

However, rest assured when your customer adds items to the cart and go to the checkout screen, they will still be redirected to https://squareup.comdomain with SSL during the checkout flow.

There definitely seems to be some confusion about when to use Let's Encrypt. I checked on this for you and at this time Let's Encrypt is only used by developers using Square's Transaction API. Developers can refer to this TLS and HTTPS technical documentation for more information. I've updated the post above too to reflect this. Thanks for bringing it to my attention!

[Vivosity]

OK. Thank you.

[PinkMoon]

I'm looking to confirm what I think I'm reading above.  I have an online store on Squareup, @Helen.  I am pointing it to my biz URL domain name, which I acquired via Google Domains.   That URL depicts my site as NOT SECURE with the little i in a circle with a warning that says to not use credit cards.

Do I understand that there is NO FIX for this?  To have an online store that gives a warning to not use credit cards seems to be significant shortcoming.   Or is there a fix for my scenario that I can chase down?

[Helen]

Hello @PinkMoon. When your customers are at the checkout screen for your Square Online Store (i.e. the page where they enter their card information) they should see the SSL certificate and the URL will begin https. 

Have you contacted Google Domains to ask them about how to get an SSL? Or if you have can you let me know what they said? 

[PinkMoon]

Yes, the Cart page does show as Secure.  But the pages where my merchandise appear all have the "warning" icon.  

Google Domains says to use a web-hosting partner that provides SSL certificates.  SquareUp is my web-hosting partner, right? 

Google Domains says a workaround is to acquire a certificate from a Certificate Authority (like Lets Encrypt).  However, I see no way for me to INSTALL certificate on my SquareUp hosted site (on-line store).  

[Helen]

Thanks for checking that @PinkMoon. I also asked engineers about this for you, and they confirmed that it's not possible to install an SSL on your Square Online store if you're using a custom domain.

As mentioned above the checkout page does have an SSL cerificate but I know you want this to appear on every page! I've shared that request with the Online Store team. 

[PinkMoon]

@Helen, thank you so much for checking, even if I was looking for a better answer.  Particularly, thank you for carrying this forward to the Online Store Development Team.

This problem just became worse.  With the latest Chrome update, my URL is now explicitly saying "Not Secure."  That's a Google change that happened just this month.  It's Google policy to label anything not HTTPS as "Not Secure."  That's bad advertising for an online store.

Perhaps the Google/Chrome policy change can help move getting HTTPS for Online Stores HIGHER in the Online Store Team's priority list?

[jenie]

Agreed, this should absolutely be moved higher up on the Square Team's priority list. It doesn't make any sense to have a store subdomain that appears as "Not Secure" to a customer. This should be just a default, not something we as users of the platform need to add on the backend of our websites. That's the whole point of using an already built platform instead of building one from scratch yourself.

[Msprity]

Helen, you moved my thread to this one, so can someone tell me how to add my ssl certificate to my custom domain?

[puka]

Hey @Msprity - Your post was moved here as we do not provide SSL certificates. but this thread contains some workarounds from other Sellers. We recommend taking a read through it to see if you find a solution that works for you.

[Mushroomjesus]

im having this issue. why would square offer the use of a custom domain when its not possible for it to be secure? 

[Valerie-Claude]

This reply was created from merging an existing thread: Square Online Store and custom domain

I want to use a custom domain purchased from Go Daddy on the Square Online store. When I link the third party domain to Square outlined in the help section.....the Store seem not secured, not https....do I need to purchase other add on and certificate to secure and use the Square Online store?

[Valerie-Claude]

I want to use a custom domain purchased from Go Daddy on the Square Online store. When I link the third party domain to Square outlined in the help section.....the Store seem not secured, not https....do I need to purchase other add on and certificate to secure and use the Square Online store?

[Helen]

@Valerie-Claude We've shared some information about this in a different thread here: How do I set up an SSL for my custom domain? I think that will help but if you have any other questions let me know! 

[jenie]

"At this time we do not provide SSL certificates but you can get one through Let’s Encrypt for free. Hope this helps get you in the right direction. Update: Let's Encrypt can be used with Square's Transaction API, it cannot be used with Square's Online Store."

So if it can't be used with Square's Online Store, does this help us with the solution we are looking for? It sounds like everyone here is trying to get rid of the "Not Secure" message on their online store, which based on your message Update, is impossible. Could you please clarify? Thanks.

[Chad]

Hey @jenie, I'll make sure to share your feedback with the team. 

If this is something that you absolutely need for your business, I recommend checking out our partnership with Weebly. Weebly offers SSL certificates for websites with custom domain names. Currently their E-commerce options start at $8 dollars a month and the processing fee for payments is the same as the Online Store. 

[guilder68]

I have spent a very frustrating morning trying to add SSL to my online Square up store. If Square will not allow an SSL certificate to be attached to my website, it is virtually useless to have one. Nobody is going to get to the secure cart page if the website they are looking at has a "not secure" message. And it will be annoying and embarrassing to have to explain that to customers as well...

I'm pretty disappointed, I spent hours updating all of my stock so I could have my website connected to my Square reader. Seems like it might have been a waste of time..I'm currently on hold with one of your Square representatives right now. Hopefully they can figure this out..

[owandzo]

Did you ever arrive at a solution for the "Not Secure" issue with the Square Up storefront?

[Tom]

Hey @owandzo, I went to check for updates on this and there aren't any developments related to the Square Online Store that I can share out—though, it does not look like this will be resolved in the near future. For now, I would echo Chad's post above as our partnership with Weebly will address this issue. Hope this helps get you where you need to be. Apologies for any frustration and thanks for your patience.