CodePen Projects and Custom Domains: SSL/TLS Provisioning Behavior

Answer

CodePen automatically provisions and renews managed SSL/TLS certificates for custom domains only when the domain is proxied through Cloudflare (orange‑cloud). For non‑proxied (grey‑cloud) domains the platform does not issue a certificate automatically, so HTTPS may be unavailable until DNS propagates and a certificate can be manually requested.

Likely explanation

The automation relies on Cloudflare’s edge which uses Let’s Encrypt and SNI to serve the correct certificate once the domain resolves to the edge. Certificate renewal occurs automatically before the 90‑day expiry, typically without user interaction.

Confirmed facts

• Custom domains are mapped via a CNAME record that points to the CodePen CDN endpoint (for example cname.codepen.io).
• When the domain is set to orange‑cloud in Cloudflare, HTTPS is served immediately with a valid certificate.
• Certificate issuance and renewal are handled by Cloudflare without manual intervention.
• Renewals occur automatically before expiration, typically every 90 days for Let’s Encrypt.

Steps to verify and ensure continuity

1. Confirm the CNAME record in your DNS points to cname.codepen.io (or the endpoint shown in CodePen’s domain settings).
2. Log into Cloudflare, locate the added domain, and verify that the DNS record is orange‑cloud (proxied).
3. In Cloudflare’s SSL/TLS tab, check that the certificate status shows “Let’s Encrypt” and is “Active”.
4. After any DNS change, monitor the site for a few minutes; HTTPS should be available immediately if the domain is proxied, otherwise wait for DNS TTL and certificate issuance.
5. If HTTPS is not present after the expected period, investigate whether the domain remains grey‑cloud or if the CNAME points to an incorrect endpoint.

Missing diagnostic

Please indicate whether the custom domain is configured with Cloudflare’s orange‑cloud proxy; this determines if automatic TLS is in effect and whether any downtime is expected.