SSL certificates

Every website hosted on Templ gets a free SSL certificate from Let's Encrypt that is installed and renewed automatically. You do not need to buy, install, or renew anything.

How automatic SSL works

A certificate is issued automatically once your domain resolves to Templ, and it is renewed automatically before it expires.

If Templ manages your DNS (your domain uses Templ's name servers), there is nothing for you to do. The certificate is generated automatically once the domain is added and its records have propagated.
If you manage your DNS externally (the domain points to Templ via A-records or your own name servers), the certificate can only be generated once those records are correct and have propagated. Most delays and failures come from this case.

Why is my certificate taking long or not generated yet?

When you add a domain, the Panel shows:

Your domain has been added, but it has no SSL certificate yet. A certificate will be generated once the DNS records are up to date and propagated.

This means Let's Encrypt cannot yet verify that the domain points to Templ. If Templ manages your DNS, this resolves on its own once records propagate. If you manage DNS externally, check the following - in order of how common they are.

1. DNS hasn't propagated yet

DNS changes take time to spread across the internet.

Name server changes: allow 4 to 8 hours for .com and .net domains, and 24 to 48 hours for other extensions.
A-record changes: usually faster, but still depend on your previous TTL.

We recommend DNS Checker to verify your records from locations around the world: enter your domain, select the record type (A for A-records, NS for name server changes), and confirm it resolves to Templ everywhere before expecting a certificate. Green checkmarks across all locations mean the change has propagated.

For faster propagation next time, lower the record's TTL to the minimum (typically 5 minutes) about an hour before making the change.

2. A-records for @ and www don't match

The A-records for both @ and www must point to your website's IP address on Templ, and they must be identical. A certificate covers both the root domain and the www version, so if only one is correct - or they point to different IPs - generation fails.

Find your website's IP under Websites → your website → Overview in the Panel, then set both @ and www A-records to it. See Change an A record for the full steps.

To verify, use DNS Checker: enter your domain, select A from the dropdown, and confirm it returns your Templ IP - then repeat for the www version.

3. AAAA (IPv6) records exist on @ or www

Delete any AAAA records for @ and www. These are IPv6 records and are not used on Templ. If they exist, DNS resolves over IPv6 to somewhere other than Templ, which contradicts your A-record and blocks automated SSL generation.

Confirm none exist with DNS Checker: enter your domain, select AAAA from the dropdown, and check that no records are returned for either @ or www.

4. The domain is proxied through Cloudflare

If your domain is proxied through your own Cloudflare account (the orange cloud in Cloudflare's DNS settings), it resolves to Cloudflare's IP addresses instead of Templ's.

Automatic SSL generation is not retried for proxied domains: as long as the domain does not resolve directly to Templ, a failed or pending certificate will not be generated automatically - even after the original cause of the failure is gone.

We recommend deactivating the Cloudflare proxy (switch the @ and www records to DNS only) until the SSL certificate has been generated, then activating the proxy again once it's done.

If the certificate still doesn't appear after the proxy is off and DNS has propagated, generate it manually as described below.

5. A temporary queue on Templ

Occasionally there's a short delay on our side: when many certificates are being generated or renewed at the same time, new requests queue up and take a little longer to process. If your DNS is correct and fully propagated but the certificate still isn't there, wait a bit longer or trigger it manually below. If it still doesn't appear, contact support and we'll look into it.

Generate the SSL certificate manually

If the certificate hasn't been generated automatically after your DNS is correct and fully propagated, you can trigger it yourself.

The button works at any time, but generation only succeeds once your A-records (or name servers) have fully propagated. Triggering it too early fails for the same reason automatic generation did.

Go to Domains in the left menu of the Templ Panel.
Find your domain, click on it, and click Generate SSL Certificate.

Templ Panel Generate SSL Certificate button on the domain page

The Generate SSL Certificate button is shown whenever that domain has no certificate and no other operation is running on it - it does not wait for DNS to propagate. If you don't see it, the domain already has a certificate, or an operation on it is still in progress: wait for it to finish and reload the page. Each domain entry has its own button, so check the entry for the exact domain you added (for example www.example.com if you added it separately).

If it still fails, contact support - the DNS records are almost always the cause.

Install a custom SSL certificate

The free automatic certificate is enough for the vast majority of sites. If you need to install a certificate from a third-party provider (for example an EV or wildcard certificate purchased elsewhere), you can.

Preparation

This assumes you have already bought your certificate and downloaded the certificate files. The files needed for installation on Templ are the SSL certificates for Nginx:

domain.com.cert - the SSL certificate, which should also include the certificate chain
domain.com.key - the private key

Some providers deliver the certificate and its chain as two separate files:

domain.com.cert
domain_com.ca-bundle (the certificate chain as a separate file)

These must be combined into a single domain.com.cert file, which then has to match the private key.

Make sure the certificate matches the private key

The easiest way is the decoder.link certificate/key matcher: paste the certificate and key and confirm they match.

Alternatively, use openssl from the command line:

Check the certificate:

openssl x509 -noout -modulus -in your-ssl.cert |openssl md5

Check the private key:

openssl rsa -noout -modulus -in your-privatekey.key |openssl md5

Both commands should produce the same output, similar to:

(stdin)= e8efefff5545dc712313188e61231230027227

We can't install a custom SSL certificate if it doesn't match the private key.

Installation

Installing a custom certificate is handled by Templ Support. Send us the combined domain.com.cert (certificate plus chain, in Nginx format) and the matching domain.com.key via support, and we'll install it for you.

Enforce HTTPS with HSTS

SSL and the HTTP-to-HTTPS redirect are automatic, but HSTS is not. If a security scan flags a missing Strict-Transport-Security header, see Add HSTS and security headers for how to add it.