Custom Domains and Certificates — Putting Your Own Name on a Published URL

This article covers replacing a published URL with your own domain and getting it to open over https.

Right after you deploy, the URL is a long one the provider assigned automatically.

It shows what "set up a custom domain", "add an A record" and "issue a certificate" in setup instructions each actually mean.

All three deal with a different party, and the order is fixed.

Registering a domain — renting the right to use it for a period

A domain is not bought outright; you rent the right to use it for a set period, and the provider that takes the registration is the registrar — the provider that accepts domain registrations and rents out the right to use them.

Register one, and any subdomain you make by adding a name in front is yours as well.

Each subdomain can point at a different destination.

When you want production and testing kept apart, you split them with subdomains rather than registering another domain.

A domain is not a possession; it has a rental period

The registrar's console shows an expiry date, and if you forget to renew, the domain stops working.

When you register it, check the auto-renewal setting and that the contact email address still reaches you.

DNS records — the one line that ties a domain to a destination

Registering a domain on its own connects to nothing yet.

You have to write down which server to go to when that domain is opened.

Each of those pairings written as one line is a DNS record — a one-line setting that ties a domain name to its destination — and the name server is what holds the records and answers queries.

You change records at the name server; you do not touch anything inside the public server.

The one line that writes the destination as a number is the A record, and "add an A record" in setup instructions means writing this line.

A change does not spread everywhere at once

The name server's answer is remembered for a while by devices along the way. The length of time it may be remembered is the TTL (Time To Live).

Even after you change a record, some people still go to the old destination until the TTL runs out. Shortening the TTL before you switch cuts the waiting time.

Add a certificate and the site opens over https

With the destination pointed and nothing more, the site still opens only over http.

To open it over https, you put a file that shows you are the owner of that domain on the public server.

That file is the server certificate — a file the certificate authority (CA) issues after confirming the owner — and the way it confirms uses the DNS record you wrote earlier.

A certificate has an expiry date, and once it passes, the browser shows a warning.

Most deployment targets handle this issuing and renewal automatically.

An expired certificate brings a stronger warning than having no certificate at all.

Even when you leave it to auto-renewal, check before the expiry date that renewal has not stopped.

Point it first, certificate after

Register the domain, point it at the public server with a DNS record, and add the certificate after that.

The CA reads the record you wrote to confirm whether you are the owner, so no certificate can be issued while there is no record.

Where to look when the site will not open

Right after you set it up, the site sometimes will not open.

What the browser shows splits into three, and each one has a different place to look.

Checking from the top down tells you how far it has got.

If you have reached the bottom, the destination is right and only the certificate is left.

Arrow 3 is the issuing of the certificate, and arrow 4 is the CA confirming the owner.

When a user opens the site, only arrows 1 and 2 are involved.

The symptom decides where to look

Name not found means the record, cannot connect means the destination, and a warning means the certificate.

The three come in order, so checking from the top down tells you how far it has got.