Lovable custom domain with no SSL — launch blocked

Your lovable custom domain is attached in settings, but visitors get certificate warnings, HTTP-only loads, or DNS errors while *.lovable.app still works fine.

Branding was the last step before launch. You bought the domain, pasted it into Lovable or Vercel, and expected the same app on your own URL. Instead the browser shows Your connection is not private, or the domain never resolves. Preview on the default host still loads. Production on your name does not. SSL and DNS are the gate — not your React code.

What you see with a lovable custom domain stuck

Failures show up at the edge before your app bundle runs.

• Certificate error or Not secure. HTTPS fails. Chrome or Safari blocks the page.
• Domain not found. NXDOMAIN or wrong server — DNS never pointed at the host Lovable or Vercel expects.
• Works on HTTP, breaks on HTTPS. Mixed content or redirect loops when SSL is half-provisioned.
• Login breaks only on custom domain. Supabase still trusts the old lovable.app origin.
• Env vars missing on new host. Connected Vercel project has keys for preview, not the production alias you added.
• Old registrar parking page. CNAME still points at a default parking host from the domain shop.

The default Lovable URL can work while your lovable custom domain fails. That split confirms DNS or TLS — not a broken component tree. Cross-check the lovable deploy checklist for auth and env on the new origin.

Why the AI never configured DNS or SSL for you

Lovable generates application code. It does not log into your registrar. Custom domains live in hosting settings and DNS panels outside the chat. The AI may mention “add your domain” in a summary. It cannot create CNAME records at Namecheap, Cloudflare, or IONOS on your behalf.

SSL is issued by your host after DNS proves you control the name. Wrong record type, apex vs www confusion, or a leftover A record to an old server stalls certificate generation. The editor has no signal that your registrar still points at parking.

Auth and env make it worse. Code ships with window.location.origin or hardcoded preview URLs. Supabase Site URL may still list only project.lovable.app. OAuth in Google Cloud still allows that host. Your lovable custom domain loads static assets but auth callbacks get rejected.

Connecting GitHub and Vercel adds another layer. The domain attaches to Vercel. Production env vars must exist for that project — not only inside Lovable preview. See vercel env vars when the custom URL loads a shell with undefined keys.

Propagation delays fool impatient launches. DNS can take minutes to forty-eight hours depending on registrar TTL. SSL stays pending until the host sees correct records. Testing auth on a half-provisioned domain wastes another afternoon.

Fix your lovable custom domain in DNS and hosting

1. Choose apex or www. Decide whether users open yourapp.com or www.yourapp.com. Configure one primary; redirect the other.
2. Open Lovable or Vercel domain settings. Copy the exact CNAME or A record values the dashboard shows. Do not guess from an old tutorial.
3. Edit DNS at your registrar. Remove conflicting records. Point www via CNAME to the host target. For apex, use A records or ALIAS as your host documents.
4. Wait for propagation. Use a DNS lookup tool. Confirm the name resolves to the expected target before blaming SSL.
5. Trigger certificate provisioning. In Vercel or Lovable hosting, click verify or refresh. Status should move from pending to valid.
6. Force HTTPS. Enable automatic HTTPS redirects. Test https:// in a private window.
7. Update Supabase Site URL and Redirect URLs. Add the custom origin alongside the Lovable default. Update Google or GitHub OAuth authorized domains if used.
8. Confirm production env vars. Every secret the app reads must exist for Production on the connected host. Redeploy after changes.
9. Republish from Lovable if code hardcodes hosts. Search for lovable.app strings and replace with dynamic origin where needed.

Keep the default Lovable URL in Redirect URLs until the custom domain is stable. Removing preview too early breaks testing.

Cloudflare orange-cloud proxies can interfere with some hosts’ certificate issuance. If SSL stays pending, try DNS-only mode temporarily, verify the cert, then re-enable proxy once HTTPS works end to end.

Checklist before launch on your lovable custom domain

• DNS lookup returns the host Lovable or Vercel specified
• HTTPS loads without certificate warnings
• HTTP redirects to HTTPS
• Supabase Site URL includes the custom origin
• Redirect URLs list custom domain and Lovable default
• OAuth providers allow callbacks for the new host
• Production env vars set on Vercel or connected host
• Login and one API call succeed on the custom URL in a private window

FAQ

Why does my lovable custom domain show no SSL?

TLS certificates issue after DNS points correctly to your host. Wrong CNAME, stale records at your registrar, or mixed HTTP-only setup blocks provisioning. Until the cert is valid, browsers block or warn on HTTPS.

Do I need to update Supabase for a lovable custom domain?

Yes. Add the custom origin to Site URL and Redirect URLs. OAuth providers need the new callback paths too. Auth still pointing at the default Lovable hostname breaks login on your branded domain.

How long does SSL take on a lovable custom domain?

After DNS propagates, most hosts issue a cert within minutes to a few hours. If it stays pending beyond 24 hours, recheck CNAME or A records, remove conflicting old records, and confirm the domain in your hosting dashboard.