.at domain and SSL certificate: set up HTTPS correctly
Your .at domain is registered, but the browser displays a certificate warning? Separate registration, DNS and HTTPS so you can find the right place to complete the setup.
Read guide ↗The essentials
A CAA record specifies which certification authorities may issue certificates for a domain name. If your web service reports a CAA error, check the active DNS zone and obtain the confirmed required values. Saving a record alone does not confirm a completed certificate.
1. Establish what is actually failing
Your .at domain is registered and assigned to your website, but the web service reports a certificate issuance error. That is a different starting point from a domain that cannot resolve at all. Record the complete hostname, exact message and time. Does it affect the address with www, without www or a subdomain? Did the initial setup fail, or is an existing certificate failing to renew? These details help us and your website contact investigate the right stage. A browser warning alone does not prove a CAA problem. Avoid changing DNS values until you know where the process is getting stuck.
Understand domains and SSL2. What a CAA record means
CAA lets you specify which certification authorities may issue certificates for a domain name. The record does not issue a certificate itself or replace the connection between your domain and website service. A record that does not permit the intended authority can prevent issuance. CAA and HTTPS therefore have related but distinct jobs. If your web service specifically identifies CAA as the cause, ask for the complete required record. Do not simply copy another domain’s settings. The appropriate instruction depends on the certificate service actually being used.
Explore DNS management3. Keep the record fields separate
A CAA record contains flags, a tag and a value. The registered tags issue and issuewild concern ordinary and wildcard certificate issuance respectively; iodef identifies an incident reporting method. These are not interchangeable labels. Ask your website contact for the hostname, flags, tag, value and intended TTL as one complete instruction. For a wildcard certificate, have the responsible person confirm the appropriate configuration explicitly. This guide intentionally provides no ready-to-copy certification authority value: a plausible-looking but inappropriate record would not help your domain. Keep the supplied instruction together rather than piecing it together from unrelated examples.
Find help with DNS questions
4. Check the record in the active DNS zone
Before editing anything, check the active nameservers. What matters is the DNS zone publicly used for the domain name. An entry in another, unused account will not change those responses. With our default nameservers you can manage supported DNS records in your account; custom nameservers are also possible. If your domain uses custom nameservers, coordinate the change with the person managing them. Document existing CAA records and values without deleting other entries. A, AAAA, CNAME and MX data may still be needed for your website and email. Record which account contains the active zone so future work starts in the correct place.
Check the active nameservers5. Prepare a small, documented change
For an Austrian business, the practical trigger might be moving its website service: the domain stays the same, but the new website contact uses a different certificate process. Before the move, request written instructions and a named person responsible for the check. List existing services that still need certificates. Agree which CAA data should be added or adjusted and who will verify the effect. Also have the relevant person check whether parent names or alias configurations matter for the particular hostname. Avoid changing several security and DNS settings simultaneously. This makes it easier to trace which action belongs to the agreed solution and to discuss any unexpected result.
Back up your DNS inventory before changes6. Confirm issuance after saving the record
A saved DNS record is not confirmation that a certificate has been issued. Ask your website contact to check the process again after checking DNS. Record the times of the change and response. Cached answers can delay visibility; use the actual configuration and agreed checks rather than assuming a universal number of minutes. Then open the exact affected HTTPS addresses and check whether the browser receives a valid certificate. A working address without www does not automatically confirm www. Test the versions published to visitors and have any intended redirects checked separately. Keep a note of which addresses passed rather than marking the whole project complete after one visit.
Check www and the address without www
7. Plan for the next certificate renewal too
Keep the confirmed instruction with your DNS inventory. Pass it on if you later change website, DNS contact or certificate service. Arrange a check with the responsible person before the next certificate expires. Domain renewal and certificate renewal are separate processes. A standard new .at domain currently costs €12.99 total for the first year with us and €15.99 total per additional renewal year. The three-year package for new standard .at domains costs €39 total; check the current package conditions. Hosting and email mailboxes are not included. For help with a particular DNS instruction, send the error message and affected hostname through your account, without passwords or private keys.
See total prices and package detailsSearch and manage a .at domain
