Yes. Any public website should use HTTPS. Without a certificate, browsers show a "Not secure" warning, forms and logins travel in the clear, and some endings (notably .dev and .app) refuse to load over plain HTTP at all.
You do not need to buy a paid SSL certificate from StableDomains — we do not sell them. After you register a domain here, point DNS at a modern host and that host issues a free certificate (usually through Let's Encrypt or an equivalent CA) and renews it for you.
What SSL and TLS actually are
"SSL certificate" is the everyday name. The protocol in use today is TLS (Transport Layer Security); SSL itself is obsolete and must not be enabled. A certificate:
- proves the site you typed matches the server answering
- encrypts traffic between the browser and that server
- unlocks the padlock / HTTPS URL, and removes the "Not secure" label
Domain-validated (DV) certificates — the free kind hosts issue — are enough for almost every brochure site, app, blog, docs page and API.
Why you need HTTPS in 2026
- Browsers warn on HTTP. Chrome, Safari, Firefox and Edge mark plain HTTP pages as not secure. Visitors notice that before they read your content.
- Data in transit. Logins, checkout forms, cookies and API calls should not travel unencrypted on public networks.
- Search and trust. Search engines treat HTTPS as a baseline signal; mixed or missing HTTPS also breaks modern features (service workers, secure cookies, many payment flows).
- HSTS-preloaded endings. Whole TLDs such as
.devand.appare on browser HSTS preload lists. Browsers force HTTPS and will not load those sites over HTTP, even once.
How to get a free certificate after buying on StableDomains
StableDomains registers the domain and gives you DNS control. The host that serves your site issues the certificate.
- Register the domain on StableDomains (USDC or USDT on 7 chains, or card).
- Point DNS at your host. Use a free DNS template (
vercel,netlifyorgithub-pages) or set A/CNAME records yourself. See Connect a domain to Vercel. - Add the domain in the host's dashboard. Vercel, Netlify, Cloudflare Pages, GitHub Pages, Render and similar products detect the domain and request a certificate automatically.
- Wait for DNS to propagate, then confirm the padlock. Check records with the free DNS checker.
If you are not hosting a site yet and just want the name to redirect, StableDomains free URL forwarding attaches the domain and issues HTTPS automatically once DNS is live (PUT /api/v1/domains/{domain}/forward or MCP set_url_forward).
Special cases: .dev and .app
.dev and .app are HSTS-preloaded by their registry (Google Registry). That means:
- HTTPS is mandatory from day one
- a free host certificate is still the usual path
- delaying DNS or certificate setup leaves the site unreachable rather than "insecure but visible"
More detail: register a .dev domain · register a .app domain.
When a paid OV or EV certificate might matter
For most projects, paid organisation-validated (OV) or extended-validation (EV) certificates add organisation identity checks and warranties, not stronger encryption. Consider them when:
- a customer, marketplace or tender requires a named CA or OV/EV validation
- you need a wildcard that your host's free tier does not cover, and you prefer buying one certificate instead of issuing per subdomain
- a contract specifies a warranty amount tied to the certificate
If none of those apply, the free DV certificate from your host is the correct answer. StableDomains does not sell SSL products; buy a paid certificate from a CA or through your host if you truly need one.
Troubleshooting
Certificate stuck on "pending". DNS for the apex and www (if used) must already point at the host. Propagation can take minutes to a few hours. Re-check with the DNS checker, then retry the host's "refresh certificate" action.
CAA records blocking issuance. Some zones publish Certification Authority Authorization (CAA) records that limit which CAs may issue. StableDomains hosted DNS supports A, AAAA, CNAME, MX, TXT and NS — not CAA. If you need CAA, set custom nameservers and manage the zone at a DNS provider that supports it, or remove a restrictive CAA at the previous DNS host before switching.
URL forwarding and HTTPS. Free forwarding on StableDomains issues HTTPS on the forwarded host once it is attached. Target URLs should themselves be https://…. If the forward looks broken, confirm DNS for @ / www matches the forward records and wait for propagation.
Mixed content. The certificate can be valid while the padlock still looks broken if the page loads images, scripts or fonts over http://. Fix those asset URLs to HTTPS (or protocol-relative / root-relative paths your host rewrites).
Wrong hostname. A certificate issued for www.example.com does not automatically cover example.com. Add both hostnames in the host dashboard (or use a wildcard where your host supports it).
FAQ
Do I need an SSL certificate for my domain? Yes, for any public website. Free certificates from modern hosts are enough for almost every site.
Does StableDomains sell SSL certificates? No. We register domains and provide DNS and free URL forwarding. Your host (or the forwarding service) issues HTTPS.
Is Let's Encrypt good enough? Yes for typical sites. It is a widely trusted certificate authority; hosts that use it renew certificates automatically.
Do .dev and .app require HTTPS? Yes. Both endings are HSTS-preloaded, so browsers force HTTPS and will not load them over plain HTTP.
How long until the free certificate appears? Usually minutes after DNS points at the host. If it stalls, verify A/CNAME values, wait for propagation, then refresh in the host UI.
Can my AI agent set this up?
An agent can register the domain and apply DNS (MCP tools such as apply_dns_template, set_dns, set_url_forward) through StableDomains. Certificate issuance itself is handled by the host once DNS is correct. See buy a domain from an AI agent.
Get started
Search for a domain on StableDomains → · Connect DNS to Vercel · .dev domains · .app domains