You can enable HTTPS on a custom-domain Blogger blog without manually installing a certificate on the server. Blogger handles the SSL certificate automatically, but the domain must point to the correct DNS records and must not have a CAA policy that blocks Let’s Encrypt. In a typical setup, you need to complete the DNS configuration, enable HTTPS Availability, wait for the certificate to be issued, and then enable HTTPS Redirect. If a CAA error appears, add a record for letsencrypt.org at your domain’s DNS provider (according to Blogger Help).
Prerequisites for enabling HTTPS on Blogger
Before making changes, determine the blog’s primary address. Blogger does not host blogs on a bare apex domain such as example.com; you must use a subdomain such as www.example.com or blog.example.com. The apex domain can be redirected to the version with www using Google’s four A records (according to Set up a custom domain).
- You have access to your domain registrar’s DNS management panel.
- The blog’s custom domain has been added in Blogger under Settings > Publishing > Custom domain.
- You have saved the two CNAME records provided by Blogger: one CNAME pointing to
ghs.google.comand a blog-specific security CNAME. - If you want to
example.comswitch towww.example.com, you have prepared Google’s four A records. - Do not enable a proxy or intermediary CDN while the certificate is being issued, or at minimum make sure you know how to check the DNS records actually being published.
To avoid confusion, these are three separate settings:
- Custom domain: connects a custom domain to the blog.
- Redirect domain: redirects the apex domain to the domain with
www, not HTTP to HTTPS. - HTTPS Redirect: forces access over an encrypted HTTPS connection after the certificate is ready.
If you need to review additional server, DNS, or intermediary-service settings, see the Hosting & Serversection. For other Blogger configuration steps, the Blogger Guides section is more relevant.
How to enable HTTPS on a custom-domain Blogger blog
Step 1: Check and complete the DNS configuration
In Blogger, open Settings > Publishing > Custom domain. If Blogger displays a verification request, copy the two CNAME records exactly as provided. A common record has the form:
wwwor the subdomain you choose →ghs.google.com.- The hostname and random target value are issued separately by Blogger for your account and blog.
Do not replace the security CNAME value with an example found online. If you want the domain without www to redirect to the version with www, add the following four A records at your DNS host:
216.239.32.21216.239.34.21216.239.36.21216.239.38.21
Remove any old A records pointing to another host if they are also being used for the apex domain. Then return to Blogger and enable Redirect domain if you want it to example.com automatically redirect to www.example.com (according to Google Blogger Help).
Step 2: Enable HTTPS Availability
In Blogger, go to Settings > Basic, find the HTTPS section, and set HTTPS Availability to Yes. This option appears only when the blog uses a custom domain; the address blogspot.com is automatically supported for HTTPS by Blogger (see Manage your blog’s settings).
Do not enable HTTPS Redirect immediately if HTTPS Availability is not yet ready. Wait until its status changes to available, then try opening:
https://www.example.com- An older post with a specific URL.
- The version without
www, if you have configured redirection from the root domain.
Step 3: Enable HTTPS Redirect
Once the certificate is active, set HTTPS Redirect to Yes. The goal is for Blogger to take users to the HTTPS version when they enter an HTTP address. Google describes HTTPS Redirect as a setting that forces visitors to use the encrypted version of the blog; therefore, do not use Custom redirects as a substitute for this function (see Turn on HTTPS for your blog).
After enabling it, test the site in a private window or another browser. Confirm that the final address displays a padlock icon, does not enter a redirect loop, and that important pages still load.
How to Fix CAA Errors in Blogger and Let’s Encrypt
A Blogger CAA error often occurs when the domain’s DNS already contains a CAA record that does not permit Let’s Encrypt to issue a certificate. CAA is a DNS record that specifies which certificate authorities may issue certificates for a domain. When a restrictive CAA record exists, the certificate authority must follow that policy (see Let’s Encrypt Glossary).
If Blogger reports a similar error— certificate issuance was forbidden by an explicit DNS CAA record, proceed as follows:
- Open the domain’s DNS management panel.
- Find records of type CAA at the root host, usually displayed as
@or left blank. - Check whether the existing record allows only another CA, such as a previous certificate provider.
- Add a record for Let’s Encrypt with equivalent values:
Type: CAA,Name: @,Flag: 0,Tag: issue,Value: letsencrypt.org. - Save the DNS changes, wait for the system to update, and then return to Blogger and enable HTTPS Availability again.
Some DNS interfaces combine the CAA fields into a single value. In that case, the record is usually entered in the form 0 issue "letsencrypt.org". Do not create a TXT record instead of a CAA record, and do not add a trailing period or quotation marks if the control panel formats them automatically.
If you already have a CAA record for another CA, do not delete it immediately if other services on the domain still use certificates. You can keep multiple issue, provided that your policy allows Let’s Encrypt. Check with your DNS provider if the interface does not clearly indicate how to enter the record.
Checks, Common Errors, and Fixes
HTTPS Availability still shows No
First, check that each CNAME is correct, especially the security CNAME provided by Blogger. Next, check whether public DNS returns the new record. If you have just changed the DNS, wait for resolution to complete before enabling HTTPS again. Repeatedly toggling the setting within a short period can make it difficult to determine which change has taken effect.
Redirect loop or page does not open
Check whether HTTPS is enabled at multiple layers, such as Blogger, a CDN, and a plugin or external redirection service. Blogger already handles HTTPS for the blog; adding redirection rules at the proxy can create a loop. Temporarily disable the proxy, keep DNS in standard resolution mode, confirm that the certificate is working, and then re-enable the intermediary service.
Root domain does not redirect to www
This is usually caused by missing or incorrect Google A records, not a certificate issue. Check the A records for @, remove old IP addresses, and enable Redirect domain in Blogger. A CNAME www does not replace the four A records used to handle the root domain.
The site has HTTPS, but the browser reports that the content is not secure
This is usually a mixed-content issue: the theme or posts still load images, scripts, or icons over http://. Update the resource URLs to https://, replace absolute paths with relative paths where appropriate, then clear the cache and check again using the browser’s developer tools.
Finally, check the main URLs in Google Search Console and update the sitemap if necessary. HTTPS helps protect the connection but does not, by itself, improve content quality or rankings. You can combine this step with a blog optimization checklist to review the site structure, accessibility, and related technical factors.
Configuration completion checklist
- The subdomain points to the correct Blogger CNAME.
- The security CNAME was copied exactly from Blogger.
- All four Google A records have been added when using the root domain.
- CAA permits
letsencrypt.orgif the domain has a CAA policy in place. - HTTPS Availability has changed to Available.
- HTTPS Redirect is enabled only after the certificate is active.
- HTTP, HTTPS, www, and non-www have been checked in a private-browsing window.
- There is no remaining mixed content or redirect loop.
Reference source
- Turn on HTTPS for your blog — Blogger Help.
- Set up a custom domain — Blogger Help.
- Manage your blog’s settings — Blogger Help.
- Let’s Encrypt Glossary — Let’s Encrypt.
- ISRG CP v3.1 — Internet Security Research Group.
