Hosting · Updated 10 November 2026 · 8 min read

How custom domains and HTTPS work on a hosting platform

Q: Why does my .dev domain show an error while my .com works?

The whole .dev top-level domain is on the HSTS preload list, so browsers load it only over HTTPS. If your host requests the certificate after traffic arrives, there's a short window with no valid certificate. A host that validates through DNS before the switch avoids it.

The DNS records, ownership checks and free certificates behind your own domain, how five platforms handle them, and the setup mistakes that break HTTPS.

View as Markdown

You keep your domain at your registrar or DNS provider and add a record that sends visitors to the platform. The platform then proves to a certificate authority, usually Let's Encrypt, that it may serve that name, gets a free certificate and renews it for you. Platforms differ in which records you add, whether the certificate exists before traffic arrives, and how they treat the bare example.com name.

The three jobs a custom domain does

Routing. Browsers must find the platform's servers. A subdomain such as app.example.com normally gets a CNAME record that points at a name the platform controls. The bare domain, called the apex, can't hold a CNAME, so it gets an A record with an IP address, or an ALIAS or ANAME record if your DNS provider offers one.
Ownership. The platform must know you control the name before it serves your app on it, or anyone could claim your domain.
A certificate. HTTPS needs a certificate for the exact name. Let's Encrypt only issues one after a challenge proves control of the domain.

How the certificate challenge works

Let's Encrypt validates control through challenges defined by the ACME standard. The two you'll meet on hosting platforms:

Challenge	How it proves control	Wildcards	When it can run
HTTP-01	Fetches a token file from `http://your-domain/.well-known/acme-challenge/` on port 80	No	Only after the domain points at the platform
DNS-01	Looks up a TXT record at `_acme-challenge.your-domain`	Yes	Before or after traffic moves

Let's Encrypt follows CNAME records when it looks up that TXT record. That lets a platform ask you for one CNAME at _acme-challenge that hands the challenge to a zone it controls, so it can answer every renewal without access to your DNS account. Default Let's Encrypt certificates last 90 days, and its FAQ recommends renewing after 60, so automatic renewal isn't optional.

Why the order matters

With HTTP-01, the certificate can only be requested once your domain points at the new host. Until it arrives, visitors reach a server that has no valid certificate for your name. On a domain whose top-level domain is on the HSTS preload list, such as every .dev domain, browsers refuse plain HTTP outright, so the site fails to load until the certificate lands.

DNS-01 through a delegated CNAME avoids that gap: the certificate is issued first, and only then do you move the traffic record. Some HTTP-01 hosts offer a workaround for migrations: Vercel, for example, can pre-generate a certificate once you add TXT records it gives you.

Custom domains at a glance

Platform	Subdomain record	Apex record	Certificate	Domains included
Eurobase	CNAME to `edge.eurobase.dev`	A record to the address it shows	Let's Encrypt, issued before traffic moves	1 on Free, 10 on Starter and Pro per workspace
Clever Cloud	CNAME to the region's domain	A records of the region	Let's Encrypt; wildcards need your own certificate	Not stated
Scalingo	CNAME to the app's `scalingo.io` name	ALIAS or ANAME; A records discouraged	Let's Encrypt once DNS points at Scalingo	20 per app by default
Render	Listed per DNS provider in the dashboard	Listed per DNS provider in the dashboard	Automatic, wildcards included	2 on Hobby, 15 on Pro, 25 on Scale per workspace, then $0.25 a month each
Vercel	A CNAME unique to the project	A record	Let's Encrypt; HTTP-01, DNS-01 for wildcards	50 per project on Hobby

Records and limits come from each platform's own docs, read on 10 November 2026.

What to check before you connect a domain

Apex support. If you want example.com without www, check whether the host gives you a stable A record, and whether it promises to warn you before that address changes. Scalingo, for example, says its ingress addresses may change with 30 days' notice.
What happens to www. Some hosts add www for you and redirect it. On others you add it as a second domain.
IPv6 records. Old AAAA records at the same name send some visitors elsewhere. Render tells you to remove them, and Eurobase reports a domain with stray AAAA records as pointing somewhere else.
CAA records. If your zone has CAA records, they must allow the certificate authority your host uses. Render lists Let's Encrypt and Google Trust Services.
Wildcards. *.example.com needs DNS-01. Clever Cloud doesn't generate wildcard certificates; Render and Vercel do with extra records.

How it works on Eurobase

Eurobase serves your app from European infrastructure run by Scaleway, a French provider. It doesn't host your DNS or sell domains. Domains belong to the workspace, and only the workspace owner can connect, move or remove them.

Open Domains in the sidebar, select Connect domain, enter the name and choose the project it should serve. You can also add a domain with no project yet; it keeps its records and certificate and serves nothing until you link it.
Add the records Eurobase lists at your DNS provider. The first is a CNAME from _acme-challenge.<your domain> to a random label under _acme.eurobase.dev. Only someone who controls your DNS can create it, so it's the ownership proof, and it lets Eurobase answer Let's Encrypt's DNS-01 challenge.
Add the traffic record: a CNAME to edge.eurobase.dev for a subdomain, or an A record to the edge address shown for an apex. An ALIAS to edge.eurobase.dev at the apex is also accepted.
Wait for the status to move from Waiting for DNS to Issuing certificate to Active. A claim fails if the challenge record never appears within 7 days, or if the certificate isn't ready 24 hours after issuing starts.

Because the challenge is delegated, the certificate is ready before your traffic record changes, so a .dev domain doesn't show a certificate error during the switch. Anyone who opens the http:// address lands on the HTTPS one.

For an apex domain, Eurobase also offers www as an optional step with two more records. Once its certificate covers www, visitors to www.example.com get a permanent redirect to example.com, and the www name doesn't count toward your domain limit.

Two things surprise people after the move:

The eurobase.dev address goes quiet. While your domain is active and pointing at Eurobase, it becomes the project's address, and the project's eurobase.dev host answers visitors with a 404. It serves again if you unlink or remove the domain.
The challenge record must stay. If the _acme-challenge CNAME is missing for 72 hours, the domain goes back to Waiting for DNS and stops serving until you restore it. The workspace owner gets a notification when that record goes missing or a domain stops serving.

A workspace on Free gets one custom domain; Starter, €10 a month + VAT, and Pro, €20 a month + VAT, raise that to ten. There are no usage charges today: work over a limit is refused, apps on V8 isolates and Functions stop until the monthly reset, and containers and static sites keep serving.

Moving a live domain without downtime

A day ahead, shorten the TTL on the records you'll change, so resolvers drop the old answer quickly.
Connect the domain on the new host first and add any ownership or challenge record it asks for.
On a host that issues certificates before traffic moves, wait until the domain shows as ready. On an HTTP-01 host, use its pre-generation option if it has one, or plan a quiet moment for the switch.
Change the traffic record, then load the site over HTTPS from another network.
Remove the domain from the old platform only after the new one serves it.

Moving from a specific platform? The Vercel, Netlify and GitHub Pages guides cover the domain step for each.

Frequently asked questions

Do I have to move my DNS to the hosting platform?

No. Eurobase, Clever Cloud, Scalingo and Render all work with records you add at your current DNS provider. Vercel also offers a nameserver method, where Vercel hosts the whole zone, but changing only the A or CNAME record is enough.

Why can't I use a CNAME on example.com?

Most DNS providers don't allow a CNAME on the bare domain. Use the A record your host gives you, or an ALIAS or ANAME record if your DNS provider supports one.

How long does HTTPS take after I add the records?

It depends on DNS caching and the host's checks. Scalingo checks DNS every 60 seconds before requesting a certificate. On Eurobase, the certificate is issued once the challenge CNAME is visible in public DNS, before you move traffic.

Do I need to buy an SSL certificate?

Usually not. Eurobase, Clever Cloud, Scalingo, Render and Vercel all issue and renew certificates for you automatically. Buy one only if you need a certificate type Let's Encrypt doesn't issue, such as organization or extended validation.

Why does my .dev domain show an error while my .com works?

The whole .dev top-level domain is on the HSTS preload list, so browsers load it only over HTTPS. If your host requests the certificate after traffic arrives, there's a short window with no valid certificate. A host that validates through DNS before the switch avoids it.