You've connected a custom domain, but the browser shows "Your connection is not private" or an invalid-certificate error. Don't worry — this is almost always a DNS-level issue you can fix yourself in a few minutes.
First, rule out the two quick culprits: DNS that simply hasn't propagated yet (give it up to 24 hours after creating the CNAME described in Connecting a custom domain), and Cloudflare's proxy mode — the record must be DNS only (gray cloud) so the certificate can be issued. If both look right and the warning persists, the culprit is usually a CAA record.
Fixing certificate issuance with CAA records
CAA records tell certificate authorities who may issue certificates for your domain. If your domain already has CAA records and none of them include Let's Encrypt — the authority Emovart uses — issuance is silently refused. The fix is one extra DNS record on your root domain: type CAA, flag 0, tag issue, value "letsencrypt.org". Add it alongside your existing CAA entries (don't delete the ones authorizing other providers), then press Verify on your domain in the console to trigger a fresh attempt.
Testing your CAA records
You can inspect a domain's CAA records with any DNS lookup tool — run dig yourcompany.com CAA in a terminal, or use one of the free online CAA checkers.
🚫 What a blocking setup looks like
The lookup returns CAA entries, but letsencrypt.org isn't among them — issuance will keep failing until it's added:
✅ What a working setup looks like
After adding the record, letsencrypt.org shows up among the allowed issuers. Within a few minutes the certificate can be issued and the warning disappears:
Good to know: a domain with no CAA records at all is perfectly fine — no CAA means any authority may issue. You only need to act when CAA records exist and exclude Let's Encrypt. Still stuck after 24 hours? Reach out via the Contact button and we'll dig in with you.