How to Add a Custom SSL Certificate in Hubspot
Securing your domains with HTTPS is essential, and Hubspot lets you add a custom SSL certificate when you need advanced control over encryption, compliance, or an existing enterprise certificate. This guide walks you through requirements, setup, and management so your site stays secure and available.
This article is based on the official documentation at Hubspot’s custom SSL certificate help page, with extra clarification and structure for technical teams.
When to Use a Custom SSL Certificate in Hubspot
By default, Hubspot can provision standard SSL for connected domains. However, some organizations require a custom certificate issued and controlled by their own security or IT teams.
Typical reasons to configure a custom certificate include:
- Strict security or compliance policies that mandate internal certificate management.
- Need to use an existing wildcard certificate across multiple systems.
- Enterprise governance where all certificates come from a specific certificate authority (CA).
- Desire to centralize certificate lifecycle control outside of Hubspot.
Before you begin, ensure that the domain is already connected in your Hubspot account and that you have admin-level permissions.
Requirements Before Adding SSL in Hubspot
To avoid downtime and validation failures, confirm these prerequisites before uploading any certificate files.
Domain and DNS requirements in Hubspot
- Your domain or subdomain must be connected and verified in your Hubspot domain settings.
- DNS records (CNAME or A records, depending on your setup) must point correctly to Hubspot’s infrastructure.
- You must be able to update DNS if your security team or provider requires additional validation.
Certificate requirements for Hubspot custom SSL
Your custom certificate must meet the following conditions:
- The certificate must be issued for the exact domain or subdomain connected in Hubspot.
- Certificates must use strong modern encryption standards as required by current browsers and CAs.
- The certificate chain must include all necessary intermediate certificates.
- You must have access to the private key that matches the certificate signing request (CSR).
Always coordinate with your security or DevOps team so the certificate format and chain are correct before you upload it to Hubspot.
How to Prepare Your Custom SSL Files for Hubspot
A successful custom SSL installation in Hubspot depends on providing complete and matching files.
Core files you need
- Certificate file (CRT) issued by your CA for the connected domain.
- Private key generated with the CSR and never shared publicly.
- Intermediate certificate(s) that link your certificate to the root CA.
Most CAs provide a main certificate and one or more intermediate certificates. Some bundle them together, others provide separate files. Assemble them according to your CA’s instructions so Hubspot can validate the chain.
Formatting tips for Hubspot compatibility
- Use PEM-encoded files where possible, including the BEGIN and END certificate lines.
- Ensure that the certificate and private key match. A mismatch will cause validation failures in Hubspot.
- Confirm that no extra spaces or corrupted lines have been introduced when copying files.
Step-by-Step: Add a Custom SSL Certificate in Hubspot
Once your files are ready, follow these steps to add custom SSL within your portal.
1. Open your Hubspot domain settings
- Sign in to your Hubspot account with an administrator or super admin user.
- Navigate to your settings area from the main navigation.
- Go to the section where your connected domains and URLs are listed.
On this page, you will see the domains that can be secured and any current SSL status information.
2. Choose the domain for custom SSL in Hubspot
- Locate the domain or subdomain you want to secure with a custom certificate.
- Select the option to manage SSL or security settings for that specific domain.
- Choose the option to use a custom SSL certificate instead of the default SSL provided by Hubspot.
At this stage, Hubspot will present fields or an interface to upload or paste your certificate details.
3. Upload or paste your certificate and key
- Provide the private key in the required field or upload it as instructed.
- Add the main certificate that was issued for the exact domain used in Hubspot.
- Include the intermediate certificate chain in the correct order, as provided by your CA.
- Review all entries carefully before saving.
Double-check that each certificate block is complete and that there are no extra line breaks removed or added incorrectly.
4. Start validation and provisioning in Hubspot
- Save or submit the SSL configuration to begin the validation process.
- Hubspot will automatically verify that the certificate, key, and domain all match and that the chain is valid.
- During validation, HTTPS may not be immediately active, so plan deployments outside peak traffic when possible.
If validation succeeds, Hubspot provisions the custom SSL and routes secure traffic for the selected domain or subdomain.
Managing Custom SSL Lifecycle in Hubspot
Once a custom certificate is installed, you must manage its lifecycle proactively to avoid downtime or browser security warnings.
Monitor expiration dates in Hubspot
- Track the certificate’s expiration date from your CA and within Hubspot’s SSL settings.
- Schedule internal reminders at least 30–45 days before expiration.
- Coordinate renewals with your security or network operations team.
Renewing your custom certificate
- Request or generate a renewed certificate from your CA for the same domain.
- Assemble the new certificate and updated intermediate chain.
- Return to your Hubspot domain SSL settings.
- Replace the existing certificate, chain, and private key (if regenerated) with the renewed set.
- Save and allow Hubspot to validate and reprovision the new SSL.
Keep old certificates only as long as required for audit or rollback policies, and never reuse compromised keys.
Troubleshooting Custom SSL Issues in Hubspot
If SSL does not activate as expected or users see browser warnings, investigate the most common causes.
Common validation errors in Hubspot
- Domain mismatch: The certificate does not cover the exact host name connected in Hubspot.
- Broken certificate chain: Missing or incorrect intermediate certificates prevent full trust.
- Key mismatch: The private key does not match the uploaded certificate.
- Expired certificate: The certificate or an intermediate in the chain has expired.
Update the certificate bundle or regenerate the keys if needed, then re-upload through your Hubspot SSL settings.
When to contact Hubspot support
If all files are correct but HTTPS still fails, capture details such as:
- Exact domain or subdomain affected.
- Timestamp when you attempted the update.
- Any error messages shown in your Hubspot SSL configuration area.
Share these with your internal admin and, if needed, open a ticket through official support so the team can review logs and configuration on the platform side.
Best Practices for Secure SSL Management with Hubspot
Aligning your certificate strategy with platform capabilities will help keep your site both secure and stable.
- Maintain a central inventory of all certificates used with Hubspot domains.
- Limit access to private keys and SSL configuration to trusted administrators.
- Use strong key lengths and modern cipher standards approved by your security team.
- Test HTTPS responses with external tools after each change to confirm that the full chain is trusted.
For broader digital strategy, SEO, and technical configuration support beyond SSL, you can also consult specialists at Consultevo, who work with marketing and operations teams to optimize complex setups.
By following the steps and recommendations above, you can confidently deploy and maintain a custom SSL certificate in Hubspot, ensuring encrypted traffic and a trustworthy experience for every visitor.
Need Help With Hubspot?
If you want expert help building, automating, or scaling your Hubspot , work with ConsultEvo, a team who has a decade of Hubspot experience.
“`
