> ## Documentation Index > Fetch the complete documentation index at: https://bunny.net/docs/llms.txt > Use this file to discover all available pages before exploring further. # SSL for Custom Domains > Enable free Let's Encrypt SSL or upload your own certificate for custom hostnames. Bunny provides free auto-renewing SSL certificates via Let's Encrypt, or you can upload your own certificate from a commercial provider. ## Prerequisites Your custom domain must point to Bunny using a CNAME record before SSL validation can succeed. See [Custom Hostname](https://bunny.net/docs/cdn/custom-hostname.md) for setup instructions. > [!WARNING] > > On Cloudflare, disable the proxy option (orange cloud icon). Proxying hides > DNS resolution and prevents SSL validation from working. To issue a certificate *before* repointing your domain and avoid HTTPS downtime during migration, use [Seamless Domain Migration](https://bunny.net/docs/cdn/seamless-migration.md) instead, which validates ownership over DNS first. ## Free Let's Encrypt certificate **1. Add your custom hostname** Open your Pull Zone in the [dashboard](https://dash.bunny.net), navigate to **General** > **Hostnames**, and add your custom hostname if you haven't already. **2. Enable SSL** Find your hostname in the **Linked Hostnames** section and click **Enable**. ![Select hostname and enable SSL](https://mintcdn.com/bunnynet-cb9733c2/GYo51EPI6zuebYhU/images/cdn/select-hostnames-and-enable-ssl.png?fit=max\&auto=format\&n=GYo51EPI6zuebYhU\&q=85\&s=5eacf05f5abb8e04d490429b7c9caf21) **3. Select free certificate** Choose **Add Free Let's Encrypt Certificate** and click **Continue**. ![Enable HTTPS with Let's Encrypt](https://mintcdn.com/bunnynet-cb9733c2/1bTPx1eyQm8EK8W3/images/cdn/enable-https.png?fit=max\&auto=format\&n=1bTPx1eyQm8EK8W3\&q=85\&s=e487f9f144de53def4084cd9a57bdb48) Bunny issues and installs the certificate automatically. Renewal is handled for you. **4. Confirm CNAME configuration** Verify your CNAME record is correctly configured and click **Continue** to complete validation. ![CNAME configuration](https://mintcdn.com/bunnynet-cb9733c2/1bTPx1eyQm8EK8W3/images/cdn/cname-configuration.png?fit=max\&auto=format\&n=1bTPx1eyQm8EK8W3\&q=85\&s=b60eea30494bf48b15a6e5b79075f01f) **5. Verify it's working** Visit your domain using `https://` and confirm the certificate is valid. You can also use [SSL Labs](https://www.ssllabs.com/ssltest/) to test. ## Wildcard certificates When your domain is hosted on a [Bunny DNS](https://bunny.net/docs/dns.md) zone, Bunny automatically issues and renews a free Let's Encrypt wildcard certificate (`*.yourdomain.com`). Just follow the [Free Let's Encrypt certificate](#free-lets-encrypt-certificate) steps above with your wildcard hostname. If your domain is hosted elsewhere, move it to Bunny DNS ([DNS quickstart](https://bunny.net/docs/dns/quickstart.md)), or generate the wildcard certificate yourself (for example, with certbot using DNS validation) and [upload it manually](#custom-certificate). ## ACME passthrough to origin If your origin requests its own certificates over ACME, Bunny forwards requests to `/.well-known/acme-challenge/` through to the origin so it can complete validation and have a certificate issued directly to it. ## Custom certificate Use this option for certificates from commercial providers, or for wildcard certificates when your domain is not managed by Bunny DNS. **1. Prepare your certificate files** Bunny requires Nginx-compatible format. Combine your certificate chain into a single file by placing your domain certificate at the top, followed by intermediate certificates in order. Save as a single `.pem` file (e.g., `fullchain.pem`). You'll also need your private key file. **2. Enable SSL** Open your Pull Zone, go to **Hostnames**, find your hostname, and click **Enable**. **3. Select custom certificate** Choose **Upload your own certificate** and click **Continue**. ![Enable custom HTTPS](https://mintcdn.com/bunnynet-cb9733c2/1bTPx1eyQm8EK8W3/images/cdn/enable-custom-https.png?fit=max\&auto=format\&n=1bTPx1eyQm8EK8W3\&q=85\&s=ff525aff89a987566988ea0a1cd598b3) **4. Upload the certificate** Paste your certificate chain and private key into the respective fields, then click **Upload**. ![Upload custom SSL certificate](https://mintcdn.com/bunnynet-cb9733c2/GYo51EPI6zuebYhU/images/cdn/upload-custom-ssl-certificate.png?fit=max\&auto=format\&n=GYo51EPI6zuebYhU\&q=85\&s=4bec7d25163aee4084aab851d69a82c2) Wait for the certificate to propagate across the network. ## Troubleshooting ### SSL validation fails Common causes: * **DNS not propagated**: Use [dnschecker.org](https://dnschecker.org) to confirm your CNAME is resolving globally. After updating a DNS record, wait a few minutes before requesting the certificate so the change can propagate, otherwise our servers may read a stale cached record * **Incorrect CNAME record**: Verify with a [DNS lookup tool](https://toolbox.googleapps.com/apps/dig/) that your hostname returns a CNAME pointing to the exact hostname of your Pull Zone. If you use [Bunny DNS](https://bunny.net/docs/dns.md), point your custom domain's CNAME to your `b-cdn.net` Pull Zone hostname * **Cloudflare proxy enabled**: Disable the orange cloud icon on your CNAME record * **Geolocation blocks**: Let's Encrypt validates from multiple regions (including USA and Europe). If you've blocked these regions via Traffic Manager or Edge Rules, validation may fail * **CAA records**: If your domain has CAA DNS records, add `letsencrypt.org` to the allowed issuers ### Rate limiting Requesting certificates too many times in a short period can trigger Let's Encrypt rate limits (up to one week). Be patient when troubleshooting DNS issues before retrying. If you need SSL immediately while rate-limited, upload a [custom certificate](#custom-certificate) from another CA. ### Debugging a failed request When a certificate request fails via the dashboard or API, the returned error includes an ACME challenge URL (like `https://acme-v02.api.letsencrypt.org/acme/chall/...`). Open it to see the exact reason the issuance failed. If you're still stuck, contact [support@bunny.net](mailto:support@bunny.net). ## Root domains CNAME records aren't allowed at the apex level (`yourdomain.com`) by most DNS providers. You have two options: 1. Use a subdomain like `www.yourdomain.com` with a CNAME, then redirect the apex to it 2. Use [Bunny DNS](https://bunny.net/docs/dns.md) with [CDN Acceleration](https://bunny.net/docs/cdn/cdn-acceleration.md), which handles this automatically This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.