Your storefront can open on your own web address, such as shop.example.com. This is a custom domain. In the admin area, each web address attached to a storefront is called a binding.

Every custom domain needs an SSL certificate, so the address starts https://, visitors see the padlock and what they type is encrypted.

For every custom domain on your storefront, Infigo:

• issues a certificate from Let's Encrypt once your domain points at Infigo
• installs it, so your storefront opens over HTTPS
• renews it automatically, well before it expires

When a certificate is replaced, the new one is installed before the old one is removed, so there is no gap in HTTPS for your visitors. Let's Encrypt is a free, non-profit certificate authority, trusted by virtually all browsers and devices: your visitors get the same padlock and the same encrypted connection as with a certificate you would pay for.

• Buy SSL certificates. There is nothing to purchase.
• Send us a certificate signing request or certificate files.
• Track expiry dates or renew. Renewal is automatic.
• Tell support when your domain is ready. Once your DNS records are right, Infigo picks them up and issues the certificate on its own.

1. Add the domain to your storefront in Configuration > Storefront Management.
2. Copy the records: click the Setup needed status beside your address in the Bindings list. The window that opens lists the records for that address, each with a Copy button.
3. Add them at your DNS provider, or send them to whoever manages your DNS.

Infigo then finds your records and issues the certificate for you. The lesson Add a custom domain to your storefront walks you through every click.

One exception: if your domain uses Cloudflare (with proxying on), Azure Front Door or another proxy, contact Infigo support before you change anything.

• In your browser: a padlock next to your storefront's address. If you open the certificate details from the padlock, Let's Encrypt is the issuer and the validity period is short. This is expected.
• In Storefront Management: if your admin access includes certificate settings, the bindings list has an SSL Certificate column. Managed by Infigo means the certificate is automatic; Managed by you means you supply your own (lessons 7 and 8). If you don't see the column, that's fine: your domains are on automatic SSL unless you've arranged otherwise with support.

A domain name is the name people type to reach a website, such as example.com. You rent it from a domain registrar.

Two points often catch people out:

• www is a subdomain like any other. example.com and www.example.com are two different names. If you want both to reach your storefront, you set up both.
• A root domain is set up differently from a subdomain (see CNAME and A records below).

DNS (the Domain Name System) turns names like shop.example.com into the numeric addresses computers use to connect. Think of each DNS record as a signpost: it doesn't hold your website, it tells visitors' browsers which way to go to find it.

Your signposts live with your DNS provider: the company whose control panel holds your domain's DNS records. It is often the company you registered the domain with, but not always. If you're not sure who yours is, ask whoever registered the domain for your organisation.

Infigo tells you which records to add, and you (or your IT team) add them at your DNS provider. Leave your email (MX) and other records as they are. DNS changes usually show within minutes, but can take up to 48 hours to reach everywhere.

You use one of two record types to connect a domain. The Connect window for each domain in Storefront Management shows the exact values.

• CNAME record, for subdomains. A CNAME says "this name is another name for that name". You use it to point www.example.com or shop.example.com at your storefront. Because it points at a name rather than a fixed address, Infigo can change the servers behind it without you touching your DNS.
• A record, for the root domain. An A record points a name straight at a numeric (IP) address. The DNS standards don't allow a CNAME on a root domain, so example.com uses A records. Add both addresses Infigo shows you, so your storefront stays up if one of them is unavailable, and remove any other A records for that name, or your site may work only some of the time.

You also add one more CNAME, the SSL validation record: its name starts _acme-challenge (for example _acme-challenge.example.com). Usually one record covers your root domain and the subdomains directly under it, such as www.example.com and shop.example.com: the setup window for each address shows exactly which record it needs. It lets Infigo issue and renew your certificate without you changing your DNS again, so leave it in place.

An SSL certificate lets your storefront use a secure https:// address, so what visitors see and type is encrypted and can't be read or changed on the way. Think of it as a passport for your web address: it names the address, has start and expiry dates, and is issued by a certificate authority that browsers already trust.

• With a valid certificate: https:// and, in most browsers, a padlock in the address bar.
• Without one: a "Not secure" label, or a full-page warning such as "Your connection is not private" that stops visitors reaching your storefront.

There are different kinds of certificate, but you don't need to choose one: Infigo picks the right type for your domains automatically.

Every certificate has an expiry date and has to be replaced (renewed) before then. Across the industry, the maximum lifetime of a public certificate is being cut in steps:

That makes renewing by hand impractical. Infigo renews your certificates automatically, well before they expire, so none of this needs your attention.

1. In the admin area, click Configuration in the left sidebar.
2. Scroll down the Configuration list and click Storefront Management (or type it in Menu Search).

The page is headed Manage Account / Account Aliases and lists every storefront on your platform. This is where web addresses (bindings) are added. If you look after only one storefront, you may see just that storefront, with its own Bindings list: go straight to step 3. Can't see Storefront Management? Raise a support ticket and we'll check your admin access.

Find the storefront you want to give a web address and click the small arrow (>) at the very left of its row. The Bindings section opens underneath and lists the addresses the storefront already uses.

Each address is listed under Alias URL, with its SSL Certificate and Domain setup status beside it. If you don't see an SSL Certificate column, your admin access doesn't include certificate settings. That's fine: the steps are the same.

Tip: on a platform with many storefronts, type its name in Search storefront first.

In the Bindings section, click Add new record. The Create Account Alias window opens.

A storefront can hold 10 addresses by default (domains and aliases together). If Add new record is greyed out, the limit is reached: delete an address you no longer use, or raise a support ticket if you need more.

In the Create Account Alias window, click the Type drop-down and choose Domain.

Watch out: Type usually starts on Alias, and the Bindings list doesn't show the type afterwards, so check it shows Domain now. If you leave it on Alias, Create fails with Invalid path alias. Use only alphanumeric characters. If Domain isn't in the list, your admin role can't add domains: raise a support ticket.

Once Type is Domain, the window also shows an SSL Certificate drop-down if your admin access includes certificate settings. Leave it on Managed by Infigo (the default) unless Infigo has agreed that you manage your own certificate for this domain.

Click in Value and type the full address, for example shop.example.com (our screenshots use shop2.example.com).

• Type the address only: no https://, no slash (/), no page path and no spaces.
• Add one address at a time. www.example.com and example.com are separate addresses (you add the second one in step 7).

Click the green Create button. A green message, Binding created with success, appears at the bottom of the page. If you had the SSL Certificate drop-down, a blue banner above the Bindings list also says, for a few seconds, Certificate provisioning started for followed by your address.

If a red message appears instead (for example Invalid domain or This alias is already in use), the window stays open: correct the Value and click Create again. The Troubleshooting tab lists each message and its fix.

Your new address now appears in the Bindings list under Alias URL, with Managed by Infigo under SSL Certificate (if you see that column). Its Domain setup shows a spinner at first. To check its type later, click Edit on its row (Type shows Domain), then Cancel.

Adding the binding doesn't make the address work yet: the domain still has to point at Infigo (steps 8 to 11).

Want visitors to reach you on more than one address, such as both example.com and www.example.com? Repeat steps 3 to 6 for each one. The lesson Use both example.com and www.example.com shows the result.

After a moment, the Domain setup column beside your new address shows Setup needed (yellow). It stays that way until the DNS records are in place, then shows Ready (green). Click Setup needed. A window titled Connect followed by your address and to your shop opens (for example, Connect shop2.example.com to your shop). (Alias bindings, the short names without a dot, show a dash: they need no DNS records.)

At the top, the window says Setup needed, that a few records still need to be added, and how far you are, for example 0 of 2 steps done. Below that it lists the records you need, in order. There is nothing to work out or build yourself: you copy what it shows.

You add these records at your DNS provider: the company where you manage your domain, usually where you bought it (for example GoDaddy, 123-reg or Cloudflare). Each record is one line with a Type, a Name and a Value, and a Copy button beside the Name and the Value. Copy them exactly as shown:

1. 1. Add the security record (the SSL validation record, Name _acme-challenge). A CNAME that lets Infigo get a free security certificate for your domain (the padlock and https) and renew it automatically. Add it once and leave it in place.
2. 2. Point your domain to your shop. For a subdomain, one CNAME record: the Name is the part in front of your domain (shop2 in our example) and the Value is shown in the window. If there are A or AAAA records with that same name, delete them first, because a name can't have both. For your root domain, one A record for each address shown (delete any other A or AAAA records on it).

Name field: copy only the part shown. Your provider adds the rest of your domain for you, and some providers call this field "Host". If your provider asks for the full name, open My provider asks for the full name under the Name and copy that instead. Some providers call the Value "Points to" or "Target".

Someone else manages your domain? The window says: send them the steps above, the records are all they need. See the lesson DNS records for your IT team or DNS provider.

Log in to your DNS provider's control panel (or send the records to your IT team with a link to the lesson DNS records for your IT team or DNS provider). The lesson Worked example: add your records at GoDaddy shows each screen at one provider. Then:

Important: delete the old records first. Before you add anything, delete any existing A, AAAA or CNAME records for the names you're about to use (the root domain @, www, shop). Old records left alongside the new ones send visitors to the old and the new address in turn, so your storefront goes down at random.

1. For each subdomain (shop, www): add a CNAME record. A subdomain always uses a CNAME, never an A record. Host: the part in front of your domain. Value: the Value from the window. If the name already has another record, replace it: a name can have a CNAME or A records, not both.
2. For the root domain (example.com): add two A records, one for each IP address, with Host @ (or blank). Add both, so your storefront stays up if one of them is unavailable. Check no other A record is left on the root, including any the provider added when you bought the domain (often labelled "Parked"). Extra A records make the site work only some of the time.
3. For the domain: add the security record (the SSL validation CNAME), exactly as the window shows it. For example.com and for subdomains directly under it, such as shop.example.com, the full name is _acme-challenge.example.com, so you add it once. A subdomain two levels down (for example a.shop.example.com) needs its own, _acme-challenge.shop.example.com. If a record already exists at that name (for example an old TXT record), delete it first: a CNAME must be the only record for its name. Leave the validation records in place so your certificate keeps renewing automatically.
4. Leave everything else alone: email (MX) records, SPF and other text records, and other subdomains.

What to type in Host / Name: most providers, including GoDaddy, add your domain for you, so type only the part in front of it: www, shop or _acme-challenge. If your provider asks for the full name, type it all, for example _acme-challenge.example.com. After saving, check your domain appears once in each full name.

Once the records are saved at your DNS provider, go back to the window and choose Check again (the window's step 3, Check your setup). It shows when it last checked. DNS changes often work within minutes but can take a few hours, and occasionally up to 48 hours, so you can close the window and come back later.

Each step shows how it is going: Done, Not found yet (the record isn't there yet), or Needs fixing. For a record that is wrong, the window shows We currently see followed by what it found, and tells you to change it to the value shown or delete it.

Check it worked: the status for your address changes to Ready, and the window says everything is set up, your address is connected and its security certificate renews automatically. Keep both records in place so the certificate keeps renewing.

That's your part done. Once your records are correct, Infigo detects them and issues the SSL certificate automatically. You don't need to contact support. Give it a little time: DNS changes usually show within minutes, but can take up to 48 hours to reach everywhere.

1. Open a private (incognito) browser window, so you don't see an old saved copy.
2. Go to https:// followed by your address, for example https://shop.example.com.
3. Check the address bar shows the padlock and there is no warning.
4. Repeat for every address you added.

Optional: select the padlock and open the certificate details. The issuer is Let's Encrypt and the validity period is short: that is expected.

Still no padlock? Check your records with a free lookup such as MXToolbox DNS Lookup and see My storefront shows "Not secure" in Troubleshooting. If only one of example.com and www.example.com works, check you added both (steps 3 to 7) and both have records (step 10).

In Configuration > Storefront Management, expand your storefront, click Add new record, set Type to Domain, enter example.com in Value and click Create. You'll see Binding created with success. (Each click is shown in Add a custom domain to your storefront, steps 1 to 6.)

Click Add new record again and add www.example.com the same way. It is a separate address, so it needs its own binding. Each new binding appears in the Bindings list with Setup needed under Domain setup (the screenshot shows shop2.example.com). Click it to see the records for that address.

Both addresses now appear in the Bindings list. At your DNS provider:

• example.com uses the two A records the window shows (and no other A records).
• www.example.com uses the CNAME record the window shows.
• They share one SSL validation record, _acme-challenge (full name _acme-challenge.example.com). Each address's window shows the same record.

If only one of them is set up, the site works on one address but not the other.

These records point a domain at an Infigo storefront and let Infigo issue and renew its SSL certificate automatically. The storefront administrator will give you values from the Connect your address to your shop window in their admin area (opened from the Domain setup status): the security record and the record that points the domain to the shop, each with a Copy button. The examples below use example.com: always use the real values you were given.

Important. For every name you're about to set up (the root domain @, www, shop and so on), first delete any existing A, AAAA or CNAME records, including any the provider added when the domain was bought (often labelled "Parked").

Why: when a name has old records as well as the Infigo ones, visitors are sent to each of them in turn. Some of them reach a server that no longer hosts the site, so the storefront goes down at random and is hard to diagnose.

Delete only records for the storefront names. Leave email (MX) records, SPF and other text records, and other subdomains as they are.

A storefront that should open on both example.com and www.example.com:

• Delete the old records first. Remove existing A, AAAA or CNAME records for each storefront name before adding the Infigo ones (see the step above).
• Always use a CNAME for subdomains, never an A record. It follows any changes Infigo makes on its side, so you don't have to update it.
• One record per name. A name can have a CNAME or A records, not both. If the subdomain already has an A record or another CNAME, replace it so the Infigo CNAME is the only record for that name.
• No CNAME at the root. DNS standards don't allow a CNAME on the root domain, so the root uses the two A records. (Some providers offer a CNAME-style ALIAS or "flattening" record for the root: ask Infigo support before using one.)
• Add both A records, and remove every other A record on the root. Only the two Infigo IP addresses should be there. Two addresses keep your storefront up if one of them is unavailable. Look out for records the provider added when the domain was bought, for example one labelled "Parked". Extra A records send some visitors to the wrong server.
• www and the root domain are separate. Each needs its own records, and each must also be added as a binding in the admin area.
• Keep the validation record. Infigo needs it for the domain. It lets Infigo issue and renew the certificate without anyone changing DNS again, so leave them in place.
• Don't touch anything else. Leave email (MX) records, SPF and other text records, and other subdomains (for example mail or a separate website) as they are. The validation record doesn't change where the storefront points and doesn't affect email.

• Usually one for each domain: Infigo's certificate for your domain covers it and the subdomains directly under it, so one validation CNAME usually covers example.com, www.example.com and shop.example.com. Its full name is _acme-challenge.example.com. A subdomain two levels down, such as a.shop.example.com, needs its own at _acme-challenge.shop.example.com. Always add what each address's setup window shows.
• The value: the window shows the full record for your real domain, with a Copy button on each field. Use it exactly as shown. If Infigo support has sent you a validation record, use that exactly as sent.
• Clear the name first. A CNAME must be the only record for its name, so delete any old record (for example a TXT record) at that _acme-challenge name before adding it.
• Domains that share a record: if several of your addresses share a validation zone, the window shows the same single record. Add it once.
• No TXT record needed. Don't add a TXT record at _acme-challenge as well: Infigo looks after that.

Providers that add the domain for you. Many DNS providers, for example GoDaddy, add the domain to the end of the Host / Name automatically. On those, enter only the first part (on a provider that asks for the full name, type the whole name instead):

Providers that add the domain to the value. Some DNS tools also add the domain to the end of a CNAME value. If the saved value ends in your own domain, put a dot at the very end of the value (for example value-from-infigo.), if your provider accepts it, so it is treated as a complete name.

• The name shows the domain once.
• The value is exactly what Infigo gave.
• A free lookup such as MXToolbox DNS Lookup returns only the two Infigo IP addresses for the root domain, and MXToolbox CNAME Lookup returns the Infigo values for each subdomain and for _acme-challenge.

Once the records are correct, Infigo detects them and issues the certificate automatically, with no need to tell us.

If the domain uses Cloudflare with proxying turned on, Azure Front Door or any other proxy or CDN in front of the website, contact Infigo support before changing anything. A proxy can get in the way of the certificate, so we'll check the setup with you first.

Infigo can't change your DNS for you. These steps happen in your DNS provider's control panel and, only if you manage your own certificate, at your certificate provider. We use GoDaddy as the example because it is one of the most widely used providers. Other providers' screens, menu names and labels differ, but the records are the same: if yours looks different, look in its help pages for "add a DNS record".

Have your values ready before you start:

• Automatic SSL (Managed by Infigo): the records in the domain's setup window in Storefront Management (lesson Add a custom domain to your storefront, steps 8 and 9).
• Your own certificate (Managed by you): the records under Connection info on the certificate's row in SSL Certificate Management.

1. Sign in to GoDaddy and open the domain (for example example.com).
2. Click the DNS tab, then DNS Records.

You see the list of records, with the columns Type, Name, Data and TTL, and a Delete and Edit icon on each row. On other providers this page may be called DNS management, DNS zone or Advanced DNS.

1. In the list, find every record of type A, AAAA or CNAME whose Name is one you are about to set up: @ for the root domain, or the subdomain such as www or shop.
2. Delete each one that isn't a value Infigo gave you (the bin icon in the Delete column), including a record labelled "Parked".
3. Leave everything else: MX (email) records, TXT records such as SPF, and other subdomains.

1. Click Add New Record.
2. Type: A.
3. Name: @ (this means the root domain itself).
4. Value: the first IP address Infigo gave you. Click Add another value and enter the second one.
5. Leave TTL as it is and click Save.

Add both addresses, so your storefront stays up if one of them is unavailable. Some providers need two separate A records rather than one record with two values: the result is the same.

Only setting up a subdomain such as shop.example.com? Skip this step: subdomains don't use A records.

1. Click Add New Record.
2. Type: CNAME.
3. Name: only the part in front of your domain, for example shop or www. GoDaddy adds .example.com for you, so typing the full name would save shop.example.com.example.com.
4. Value: the value Infigo gave you for that address.
5. Click Save.

A subdomain always uses a CNAME, never an A record.

For automatic SSL, add one more CNAME the same way: Name _acme-challenge and Value exactly as the setup window shows it. Add it once for the domain and leave it in place, so your certificate keeps renewing automatically.

• Each Name shows your domain once (shop.example.com, not shop.example.com.example.com).
• The root domain has exactly the two Infigo A records and no others.
• Each Value matches what Infigo gave you, character for character.

Then, for automatic SSL, go back to the setup window in Storefront Management and choose Check again. DNS changes usually show within minutes, but can take up to 48 hours to reach everywhere.

Only for domains that are Managed by you. You buy the certificate yourself, from GoDaddy or any other certificate provider:

1. In SSL Certificate Management, download the CSR for the domain (lesson Manage your own certificate in SSL Certificate Management, step 4) and open it in a text editor such as Notepad.
2. In your certificate provider's account, buy or open the SSL certificate and, when asked, paste the whole CSR text.
3. Complete the provider's checks. If the certificate comes from a different company from the one that holds your DNS, the provider may ask you to prove you own the domain, for example by adding a record they give you at your DNS provider. Add it exactly as they show it.
4. Download the issued certificate and upload it in SSL Certificate Management with Update certificate (step 5 of that lesson).

Each provider's order and download steps differ: follow their help pages. Never send your private key to anyone, including your provider or by email.

Managing your own certificate is an exception you ask for. There are two good reasons:

• You need an Organisation Validated (OV) or Extended Validation (EV) certificate. Let's Encrypt certificates prove that you control the domain. OV and EV certificates also prove that your organisation exists, which some sectors, such as financial services, may require. Let's Encrypt doesn't issue them, so you buy one from a certificate authority (CA) that does.
• A compliance or security policy requires it, for example your organisation (or your client's) only allows certain certificate authorities, or a certification it must hold (such as ISO 27001, SOC 2 or HIPAA) calls for a certificate from a particular authority.

When a domain is Managed by you, Infigo's automatic process leaves it alone. You create the CSR, buy the certificate, upload it in SSL Certificate Management (System > SSL Certificates) and, above all, renew it before it expires. If it expires, visitors see a security warning instead of your storefront.

Renewals are getting more frequent, whichever certificate authority you use:

From March 2027 that means replacing your certificate several times a year. Decide now who will do it and how they'll be reminded: don't rely on Infigo to remind you. You buy the certificate from your certificate authority; to ask about any Infigo charges, contact Infigo Customer Support.

Self-managed certificates aren't switched on for platforms by default. Raise a support ticket that includes:

• the domain or domains you want to manage yourself
• why you need to, for example "we need an OV certificate" or "our security policy requires our own certificate authority"

We'll ask for the reason if the ticket doesn't say, and we record it. If we agree there is a genuine need, support switches managing your own certificate on for you, so you can set those domains to Managed by you and use SSL Certificate Management. Then follow the next lesson to create your CSR, buy and upload your certificate.

If your admin access includes certificate settings, the bindings list in Storefront Management shows an SSL Certificate column. Each Domain binding shows either:

• Managed by Infigo: Infigo issues and renews the certificate automatically.
• Managed by you: you supply and renew the certificate yourself.

With that access, the Create Account Alias window (or the Edit Account Alias window when you click Edit on a binding) also has an SSL Certificate drop-down with the same two choices. It starts on Managed by Infigo. It works per domain, so you can mix the two: shop.example.com can stay Managed by Infigo while secure.example.com is Managed by you. The window is named Create Account Alias for every binding type; this setting only applies when Type is Domain, not to Alias bindings (short path names under your storefront address). Only choose Managed by you for a domain Infigo has agreed you manage yourself.

If you no longer need your own certificate, raise a support ticket listing the domains to move back to Managed by Infigo. Before you do, check the domain's DNS records point to Infigo, including the SSL validation record (see DNS records for your IT team or DNS provider). Once the domain is switched back, Infigo issues the certificate automatically when it finds the records.

1. In the admin area, click System in the left sidebar.
2. Click SSL Certificates.

The SSL Certificate Management page lists your certificates and has the Add certificate, Create CSR and Apply Changes buttons. Each row also has Certificate details, Connection info and a Status, and Available slots at the bottom right shows how many more certificates you can add. It appears only once Infigo has given your admin role access. If you can't see it, raise a support ticket.

Click Create CSR (the middle button at the top right). Creating the certificate signing request here means the admin area creates and keeps the matching private key, so you never have to handle it.

Already have a certificate and private key from somewhere else? Skip to step 6.

1. Load Balancer: choose the first load balancer in the list (it may already be selected; if it shows None Selected, open the list and pick the first one), unless support tells you otherwise.
2. Name: a name you'll recognise, usually the domain.
3. Description: a short note, for example what the certificate is for.
4. Domain Names: type each domain the certificate should cover and press Enter after each.
5. Contacts: type each email address for this certificate and press Enter.
6. Country: choose from the list first, then State Name, which fills once a country is chosen.
7. Locality Name (town) and Organization (your organisation's legal name).
8. Click Create. You'll see Csr was created successfully and the new entry appears in the list.

1. On the new entry, click the three dots (...) in the Actions column.
2. Choose Download CSR. A text file named after the entry downloads: open it in a text editor such as Notepad and copy everything in it.
3. Paste the CSR text into your certificate authority's order page and complete their checks. (The lesson Worked example: add your records at GoDaddy, last step, shows what happens at the provider.)
4. Download the issued certificate. If you're offered several downloads, choose the certificate with its chain (sometimes called the full chain or bundle) in PEM format. If that doesn't upload, use the certificate on its own in PEM format. Avoid downloads that contain only the certificate authority's own root or intermediate certificates: those aren't yours.

Not sure what a file is? Open it in a text editor such as Notepad and check the first line:

1. On the same entry, click the three dots (...) again.
2. Choose Update certificate and pick the certificate file.

You'll see Certificate file successfully updated and the certificate's status shows Pending. You don't upload a key, because the admin area already holds it. Now go to step 7.

Only if you already have a certificate and private key (instead of steps 2 to 5):

1. Click Add certificate (the first button at the top right).
2. Enter a Name and a Description.
3. Load Balancer: choose the first load balancer in the list (it may already be selected; if it shows None Selected, open the list and pick the first one), unless support tells you otherwise.
4. Next to Contact, type each email address and press Enter.
5. Next to Private Key, click Upload and choose the key file; next to Certificate, click Upload and choose the certificate file.
6. Click Add.

The new certificate shows Pending. Keep the private key secure: anyone who has it can compromise the certificate. Upload the key only here, never by email. If you'd rather support installs it, attach the files to your support ticket.

1. On the certificate's row, click Connection info. It shows the DNS records for the domain: a CNAME value for a subdomain and two A record IP addresses for a root domain.
2. Add them at your DNS provider. Delete any old A, AAAA or CNAME records for the same name first, add both A records for a root domain, and always use a CNAME for a subdomain (see Worked example: add your records at GoDaddy).

Until the certificate is applied and bound, opening your address may show a page saying to contact support to configure the required platform bindings. That is expected while you finish the steps below.

A new or updated certificate shows Pending. A background job applies pending certificates automatically, usually within 10 to 20 minutes (longer when the system is busy). To start it straight away:

1. Click Apply Changes, the green button at the top right of the page.
2. The Apply Certificate Changes window warns that this can take up to 2 hours. Click Apply to confirm.

Once the certificate is applied, check it has a binding for your web address. The binding is normally created for you, but if it wasn't created automatically, add it:

1. Click the arrow at the left of the certificate's row, then the arrow next to your domain under Domains. The Bindings table opens.
2. If your web address isn't listed, click Create (to the right, above the Bindings table), enter the address in Binding, for example shop.example.com, and click Create.
3. For a wildcard certificate (*.example.com), add a binding for each address it should secure, for example shop.example.com and www.example.com.
4. If you added a binding, click Apply Changes again.

1. In Configuration > Storefront Management, expand your storefront. Check the address is in its Bindings list with SSL Certificate showing Managed by you.
2. If it isn't there, click Add new record, set Type to Domain, enter the address in Value, set SSL Certificate to Managed by you and click Create.
3. If this address is now the storefront's main address, change the Storefront URL in the storefront's General Settings to it.

The binding shows Pending, then Applied once it is live. Refresh the page to check. When it shows Applied, open your storefront in a private browser window and look for the padlock.

Applying can take up to 2 hours. Still Pending after a few hours, or the certificate's row shows Failed? Contact Infigo support.

You are responsible for renewing. The Valid to column shows when the certificate expires (Certificate details shows the issuer, subject and validity dates). Renew well before that date:

• CSR created here: renew with your certificate authority, choose Update certificate on the same entry, upload the renewed file and click Apply Changes.
• New private key, or a certificate from elsewhere: add it as a new entry (with a new CSR or Add certificate), named with the year. With Add certificate, bindings from the older certificate for the same domain move to it automatically; with a new CSR, check the binding is on the new entry (step 9). Click Apply Changes, check your storefront, then delete the old entry (three dots, then Delete) and apply again.

If your certificate authority "rekeys" your certificate, it may cancel the old one shortly afterwards, so upload the new one straight away.

Anyone who has your private key can pretend to be your storefront.

• Upload it only in SSL Certificate Management. Create the CSR here where you can, so the key never needs copying.
• If you'd like us to install it for you, upload the files to your support ticket in the help centre, rather than replying by email. Never send a key by email or chat.
• Never store it in Upload Folders, CSS Override, Global Additional Data or any other content area: content there can be served to the public.
• If you think it has been exposed, ask your certificate authority to revoke the certificate, and replace both certificate and key.