Custom domains and SSL for Odoo: how HTTPS setup works

How HTTPS works for an Odoo domain

When someone opens https://erp.example.com, four things happen in turn:

1. DNS turns the name into the server's IP address.
2. A reverse proxy, usually Nginx, answers on ports 80 and 443 and presents the certificate.
3. The certificate proves to the browser that the server really is erp.example.com, and encrypts the connection.
4. Odoo receives the request from the proxy and builds the page, including links that must also start with https://.

Most HTTPS problems with Odoo come from one of these four steps being slightly wrong. Taking them one at a time makes them easy to fix.

DNS records for an Odoo custom domain

A and AAAA records

An A record points a name at the server's IPv4 address, and an AAAA record at its IPv6 address. Create one for each name visitors will use. If the server has no IPv6 address, do not leave an old AAAA record pointing somewhere else: visitors on IPv6, and the certificate authority, may be sent to the wrong machine.

The bare domain and www

Decide which name is the main one, for example example.com or www.example.com, and redirect the other to it. A CNAME record is handy for subdomains such as www, but most DNS providers do not allow a CNAME on the bare domain itself, so use A and AAAA records there.

TTL and waiting for DNS

The TTL (time to live) says how long resolvers may cache a record. Before moving a domain to a new server, lower the TTL to a few minutes a day in advance. Then the change takes effect quickly, and you can switch back quickly if needed.

SSL certificates for Odoo with Let's Encrypt

Let's Encrypt issues free, trusted certificates through an automated protocol called ACME. The certificate authority checks that you control the domain before it issues one, using a challenge:

• HTTP-01: it fetches a token from your server over plain HTTP on port 80. This is the simplest, but port 80 must be reachable and the DNS record must already point at the server.
• DNS-01: you publish a token in a TXT record. It works when port 80 is closed, and it is the only way to get a wildcard certificate, but your server needs credentials for your DNS provider.

Certificates are getting shorter

Let's Encrypt certificates have lasted 90 days. Let's Encrypt has announced that its default certificates will move to 64 days in February 2027 and to 45 days in February 2028, following industry rules on certificate lifetimes (as of October 2026). Renewal by hand stops being practical. Automate it, and monitor expiry dates so a failed renewal is noticed before visitors see a warning.

The details are in Let's Encrypt's challenge types documentation.

Reverse proxy settings for Odoo HTTPS

Odoo itself serves plain HTTP on its own ports. Nginx sits in front, handles HTTPS, and passes requests to Odoo. A good Odoo proxy setup:

• Redirects HTTP to HTTPS on port 80, except for ACME challenges.
• Passes the forwarded headers X-Forwarded-For, X-Forwarded-Proto and X-Forwarded-Host, so Odoo knows the visitor's address and that the request came over HTTPS.
• Routes /websocket to Odoo's websocket handling, so live chat and notifications work.
• Sets a sensible upload limit for attachments and imports.
• Uses modern TLS only, TLS 1.2 and 1.3, and adds an HSTS header so browsers stay on HTTPS.

Odoo settings: proxy_mode and web.base.url

proxy_mode

Odoo's deployment documentation says to set proxy_mode = True in the configuration file when Odoo runs behind a reverse proxy. Without it, Odoo ignores the forwarded headers, thinks every visitor is on plain HTTP and may build http:// links and redirects. Only enable it when Odoo really is behind a proxy that sets those headers.

web.base.url

The web.base.url system parameter is the address Odoo uses in emails, portal links, reports and payment redirects. Odoo updates it when an administrator logs in, so if an admin once logged in on an IP address or a test domain, customers may get links to that address. Set it to your HTTPS domain, then add the system parameter web.base.url.freeze with the value True, as Odoo's domain names documentation describes.

Several websites

With the Website app, each website can have its own domain. Point each domain at the server, include it in the certificate, and set it on the website in Odoo's settings.

Using Cloudflare in front of Odoo

If your DNS is on Cloudflare, each record is either DNS only or proxied. With DNS only, visitors connect straight to your server and see your Let's Encrypt certificate. With proxying, visitors connect to Cloudflare, which then connects to your server.

If you proxy, use Cloudflare's Full (strict) encryption mode, which requires a valid certificate on your server. Weaker modes leave the connection from Cloudflare to your server unencrypted or unchecked. Also make sure ACME challenges still reach your server, or use the DNS-01 challenge.

Odoo SSL troubleshooting

• "Not secure" or a certificate warning: the certificate does not cover the name in the address bar, or it has expired. Check which names it covers.
• The certificate will not issue: DNS does not point at the server yet, an old AAAA record points elsewhere, or port 80 is blocked by a firewall.
• Redirect loop: usually a proxy (such as Cloudflare in Flexible mode) talking to the server over HTTP while the server redirects to HTTPS.
• Emails link to the wrong address: fix and freeze web.base.url.
• Mixed content warnings: proxy_mode is off, or a custom template hard-codes an http:// link.

Custom domains and SSL in CloudPilot

CloudPilot sets all of this up for each Odoo instance:

• A free subdomain with HTTPS from the start, so the instance works before your own domain is ready.
• Your own domain, aliases and redirects. CloudPilot shows the DNS record to create, checks that every A and AAAA record points at the server, and gets the certificate once DNS is right.
• Let's Encrypt certificates, one per instance covering its domain and aliases, issued and renewed automatically.
• Nginx configured for Odoo: HTTP to HTTPS redirects, forwarded headers, websockets, TLS 1.2 and 1.3, HTTP/2 and HSTS, with proxy_mode turned on in Odoo.
• Expiry alerts: CloudPilot raises a notification when a certificate has less than 14 days left.
• Auto SSL can be turned off if you terminate HTTPS elsewhere.

If you use Cloudflare with CloudPilot, keep the records DNS only: CloudPilot's DNS check expects them to resolve to your server. The steps are in Custom domains and SSL, and managed Odoo hosting explains what else CloudPilot looks after. See pricing for each plan.

Odoo custom domain and SSL questions