Setting up SSL for your custom domain

Your custom domain needs SSL — here's why it matters

If you've connected a custom domain to your Coachful coaching site and your browser still shows a "Not Secure" warning, SSL hasn't fully provisioned yet. That warning kills trust instantly — prospects who land on your coaching page and see it will bounce before they ever read your offer. Setting up SSL for your custom domain on Coachful is automatic once your DNS is configured correctly, but there are a handful of gotchas that trip coaches up every time.

This guide walks you through every step: adding your domain, pointing your DNS records, understanding how auto-SSL works, and fixing the most common issues coaches run into when the green padlock doesn't appear.

TL;DR

• Coachful provisions SSL certificates automatically via Let's Encrypt — you don't buy or upload a certificate manually.
• SSL activates only after your DNS records (A record or CNAME) point correctly to Coachful's servers.
• Propagation takes up to 48 hours, but usually completes in under 30 minutes.
• If SSL doesn't appear after 24 hours, the most common cause is an incorrect or conflicting DNS record.

How Coachful auto-SSL works

Coachful handles SSL issuance entirely on your behalf using Let's Encrypt, a free, automated certificate authority trusted by all major browsers. The moment your domain's DNS resolves correctly to Coachful's infrastructure, a certificate request is triggered, validated, and installed — typically within a few minutes of DNS propagation completing.

You never need to purchase a certificate, paste a private key, or configure anything on a web server. The entire process is handled inside the platform. Certificates auto-renew every 90 days without any action required from you.

One important detail: SSL cannot be provisioned before DNS propagation. Coachful needs to verify domain ownership by serving a challenge file at your domain. If your DNS records still point to your old host, that verification fails and the certificate won't issue. This is the single most common reason coaches wait hours wondering why SSL hasn't kicked in.

Step 1 — Add your custom domain in Coachful

Before touching your DNS, you need to register the domain inside your Coachful workspace. This tells the platform to start listening for traffic on that hostname.

1. Sign in to your coach dashboard at app.coachful.co/sign-in.
2. Navigate to Settings → Website → Custom Domain.
3. Click Add custom domain and type your full domain (e.g., coaching.yourbrand.com or www.yourbrand.com). Include the www subdomain if that's the version you want canonical.
4. Click Save. Coachful will display the DNS values you need to configure — keep this tab open.

You'll see either an A record target IP address or a CNAME target hostname (for subdomains like www or coach). Copy these values exactly — even a single extra character will break DNS resolution.

Step 2 — Configure your DNS records

Log in to wherever your domain's DNS is managed. This is usually your domain registrar (GoDaddy, Namecheap, Google Domains/Squarespace Domains, Cloudflare, etc.) — not necessarily your website host. If you're unsure, search your email for the original domain purchase confirmation.

For a root/apex domain (e.g., yourbrand.com)

1. Go to your registrar's DNS settings and find the A record for @ (or your bare domain).
2. Delete or edit any existing A records pointing to your old host.
3. Create a new A record with host @ and the IP address shown in your Coachful domain settings.
4. Set TTL to 3600 (1 hour) or the lowest value your registrar allows to speed up propagation.

For a subdomain (e.g., www.yourbrand.com or coaching.yourbrand.com)

1. Find or create a CNAME record for the subdomain prefix (e.g., www or coaching).
2. Set the value to the CNAME target shown in your Coachful settings (it will look like custom.coachful.co or a similar hostname).
3. Remove any conflicting CNAME or A records for the same subdomain.
4. Save the record.

If you're using Cloudflare

Cloudflare users: make sure the orange cloud proxy icon is turned off (gray cloud / DNS-only mode) during initial SSL provisioning. Cloudflare's proxy intercepts the Let's Encrypt HTTP-01 challenge and can prevent Coachful from validating ownership. Once your Coachful SSL certificate is active, you can re-enable the proxy if you want Cloudflare's CDN benefits — though this is optional and can sometimes cause redirect loops. When in doubt, keep it in DNS-only mode.

Step 3 — Verify DNS propagation

DNS changes don't take effect globally all at once. Your ISP, your visitors' ISPs, and various DNS resolvers around the world all cache records for a period defined by the TTL value. In practice, most propagation completes within 15–60 minutes, but can take up to 48 hours in rare cases.

Use a free tool like dnschecker.org to watch your records propagate globally in real time. Search for your domain and select the record type (A or CNAME). Once you see green checkmarks across most locations, Coachful's auto-SSL provisioning should kick in within minutes.

You can also confirm from the terminal: run dig yourbrand.com +short (macOS/Linux) or nslookup yourbrand.com (Windows) and verify the IP matches the one Coachful gave you.

Pro tip: Don't rely on your own browser to check propagation — it likely has an aggressive local DNS cache. Use an incognito window or a different network, or just use dnschecker.org to get an objective global view.

Step 4 — Confirm SSL is active in Coachful

Once DNS has propagated, go back to Settings → Website → Custom Domain in your Coachful dashboard. The domain status should update from Pending to Active, and you'll see a green SSL indicator. Visit your domain in a browser — the padlock icon in the address bar confirms SSL is live.

If you still see "Not Secure" after DNS is confirmed as correct, try a hard refresh (Ctrl+Shift+R on Windows, Cmd+Shift+R on Mac) or test in a different browser. Browser caches sometimes hold onto the old HTTP version of a page longer than expected.

Coachful's built-in website builder, custom domains, and auto-SSL are included on every paid plan — no third-party hosting or certificate management required. If you haven't set up your coaching website yet, explore what Coachful can do for your brand.

Best practices for custom domain SSL

Always redirect HTTP to HTTPS

Coachful automatically forces HTTPS redirects once SSL is active. Every visitor who arrives at http://yourbrand.com gets redirected to https://yourbrand.com without any action on your part. This is handled at the infrastructure level, so you don't need to configure redirect rules anywhere.

Set a canonical domain and stick to it

Decide early whether your canonical URL is the root domain (yourbrand.com) or the www subdomain (www.yourbrand.com). Configure only that version in Coachful. Running both without a redirect causes duplicate-content issues that hurt your SEO. Most coaches choose the root domain for simplicity.

Keep your email DNS intact

When editing DNS records for your website, be careful not to delete MX records (for email delivery) or TXT records (for SPF/DKIM/DMARC). These records live alongside your A and CNAME records. Deleting them accidentally can break your business email. Always edit only the specific record type Coachful asks you to change.

Use a low TTL before making changes

If you know you're migrating a domain to Coachful, lower your existing TTL to 300 seconds (5 minutes) a day or two beforehand. This means any DNS change you make will propagate globally in under 10 minutes instead of potentially hours. After everything is working, you can raise it back to 3600.

Troubleshooting common SSL issues

SSL is stuck on "Pending" after several hours

The certificate challenge is failing. Double-check that your A record or CNAME matches exactly what's shown in Coachful's domain settings — no trailing dots, no spaces. Also confirm you've removed all conflicting records for the same hostname. If you're on Cloudflare, disable the proxy (orange cloud → gray cloud) and wait 5 minutes before retrying.

Browser shows a certificate error or "Your connection is not private"

This usually means SSL provisioned for one version of the domain (e.g., www.yourbrand.com) but you're visiting the other version (yourbrand.com). Verify that the domain entered in Coachful exactly matches the URL you're testing in the browser — including or excluding www. If needed, add the alternate version as a separate domain in settings, or create a redirect at your registrar.

The padlock appears but some resources load over HTTP (mixed content)

Mixed content warnings happen when a secure (HTTPS) page loads scripts, images, or stylesheets over HTTP. In Coachful's website builder, all internal assets are served over HTTPS automatically. If you've embedded third-party widgets or custom HTML blocks with hardcoded http:// URLs, update those URLs to https:// or use protocol-relative URLs (//).

I deleted my domain from Coachful and re-added it — SSL won't reissue

Removing and re-adding a custom domain resets the provisioning process. DNS still needs to be correct. If your DNS was already pointing to Coachful and you just re-added the domain, the certificate should issue within a few minutes. If it doesn't, use dnschecker.org to confirm your records are still resolving correctly — occasionally a registrar reverts changes after a session timeout.

I'm using a domain purchased through a website builder — can I still use it with Coachful?

Yes, as long as you can access the DNS settings for that domain. Many website builders (Wix, Squarespace, etc.) allow you to manage DNS even if the domain was registered through them. Look for a "DNS Settings" or "Advanced DNS" option in your account. If the builder doesn't expose DNS controls, you can transfer the domain to a registrar like Namecheap or Cloudflare to gain full control.

My coaching subdomain ({slug}.coachful.co) works fine, but my custom domain doesn't have SSL yet

Your Coachful subdomain (yourname.coachful.co) is always SSL-secured because it lives on our wildcard certificate. Custom domains require a separate per-domain certificate that's issued only after correct DNS configuration. Your subdomain will continue to work as a fallback while you get your custom domain sorted — there's no rush.

Understanding certificate renewal

Let's Encrypt certificates are valid for 90 days. Coachful automatically renews them before expiry — you'll never see an "expired certificate" warning as long as your DNS continues to point to Coachful's infrastructure. If you ever move your domain away from Coachful, the certificate simply won't renew (since Coachful no longer controls that hostname), which is the expected behavior.

Renewal happens silently in the background, typically 30 days before expiry. There is no notification, no action required, and no downtime during the renewal process.

Ready to launch your coaching site with a secure custom domain?

A professional custom domain with SSL isn't just about the padlock — it's the foundation of a credible online coaching brand. Prospects trust HTTPS sites. Search engines rank them higher. Payment processors require them. Getting this right from day one means your coaching programs, booking pages, and lead-magnet funnels all project the professionalism your clients expect.

Coachful handles the certificate issuance, auto-renewal, HTTPS redirects, and CDN delivery so you can focus on coaching — not server configuration. If you're not yet on a paid plan, start your free trial at coachful.co and have your branded, SSL-secured coaching site live in under an hour. Already set up? Sign in to your workspace and head to Settings → Website → Custom Domain to get started. For more guides on websites and domain setup, browse the Coachful help center.