Agent-readable docs index: /docs/llms.txt. Full docs in one file: /docs/llms-full.txt. Download /docs/docs.zip to grep all markdown files locally.

Automatic SSL Provisioning & Validation

Every custom domain added to Shaf is secured with free, enterprise-grade TLS encryption powered by Cloudflare for SaaS. Certificate issuance, renewal, and global deployment happen automatically — zero manual action required.
Shaf certificates are deployed across 300+ global edge locations by Cloudflare. Visitors connect to the nearest point of presence for lowest latency TLS termination.

Certificate Lifecycle

Rendering diagram...
StatusMeaningTypical Duration
Pending ValidationHostname registered; awaiting DNS confirmation0–5 minutes after DNS propagation
IssuanceCertificate being distributed to edge nodes1–3 minutes
ActiveHTTPS fully live at all edge locationsOngoing
Auto-RenewalBackground renewal 30 days before expiryTransparent, zero downtime

Checking Certificate Status

In the Shaf Dashboard:
  1. Navigate to Domains in the sidebar.
  2. Locate your domain — the TLS Status badge shows the current state.
  3. Click Re-check Status to manually trigger a DNS verification check.

Apex Domain Ownership Verification

When configuring a naked / apex domain (e.g. brand.com without a link. subdomain prefix), your DNS provider may require a separate validation TXT record in addition to the CNAME:
TypeHostValue
TXT_cf-custom-hostname.yourbrand.com[Unique token shown in Shaf Console]
Copy the exact token from the Domain Settings page and add it exactly as shown. The token is unique per domain and per verification attempt.

Troubleshooting Certificate Status

Status: Pending Validation or Initializing (5+ minutes)
Cause: The CNAME record has not yet propagated globally.
Steps to resolve:
  1. Verify the CNAME exists using dig:
    dig CNAME link.yourdomain.com +short
# Expected: cname.shaf.app.
  2. If the CNAME doesn't appear, log in to your DNS provider and confirm the record was saved correctly.
  3. If the CNAME resolves but the status remains stuck, click Re-check Status in the Shaf Domains panel.
  4. DNS propagation can take up to 5 minutes depending on your registrar TTL setting.
Status: Certificate Error (CAA Failure)
Cause: Your domain has a CAA (Certificate Authority Authorization) DNS record that restricts which CAs may issue certificates, and Let's Encrypt or Google Trust Services are not listed.
Solution: Add both CAs to your CAA records:
yourdomain.com. IN CAA 0 issue "letsencrypt.org"
yourdomain.com. IN CAA 0 issue "pki.goog"
Add these records at your DNS provider, wait for propagation, then click Re-check Status.
Status: Active but visitors still see a certificate warning
Possible causes:
  1. Browser cache: The browser cached the old (invalid) certificate. Ask the visitor to clear browser cache or open an Incognito window.
  2. HSTS preload conflict: If the domain was previously registered with an HSTS preload list, older browsers may not trust the new certificate chain. This resolves as HSTS max-age expires.
  3. Proxy status in Cloudflare: If you are also using Cloudflare as your DNS provider and the CNAME is set to Proxied (orange cloud), the certificate may conflict. Set the proxy status to DNS only (grey cloud) during initial verification.
What should I do if certificate renewal shows pending or fails?
Click Re-check Status in the Domains panel. If the status shows Renewal Pending, this is normal — Shaf auto-renews certificates 30 days before expiry. If it shows an error, review the CAA records and CNAME resolution. Contact support@shaf.app if the issue persists for more than 15 minutes.