A
Aaron McQuade
## The problem
If you put a CDN in front of a domain connected to HighLevel, it works — until the certificate renews. HighLevel's CA can't validate the hostname directly through a proxy, so renewal fails and the site goes down weeks or months after the change, with nothing obviously connecting the two.
There's no workaround. Terminating TLS at the CDN and talking plain HTTP to the origin doesn't work, because the origin forces a redirect to HTTPS. And CloudFront (among others) won't serve through an origin with an invalid certificate at all — it returns 502.
## Why this matters
We're a podcast hosting company moving our marketing site to HighLevel. The domain also serves our authenticated product — login, account management, the app itself — on the same hostname. We need an edge in front so we can route specific paths to our own servers and keep the rest on HighLevel.
This isn't niche. Anyone in the same position wants it:
  • WAF or bot protection in front of a marketing site
  • path-based routing, so part of a domain is HighLevel and part is your own application
  • an existing enterprise CDN and DNS setup you can't opt out of
  • agencies whose clients mandate a CDN by policy
Right now every one of those means either not using HighLevel for that domain, or using a subdomain and giving up the main one.
What would fix it, smallest change first:
  1. DNS-01 validation. Validate via a DNS TXT record instead of hitting the hostname. Completely independent of whatever sits in front, works for root and subdomains alike, and requires no changes on the customer's side beyond a record. This alone solves it.
  2. Bring your own certificate — let customers upload a cert, or disable HighLevel-managed SSL for a connected domain, so the edge owns TLS.
  3. Allow plain HTTP on the origin so TLS can terminate at the CDN, as a documented option.
Any one of these is enough. DNS-01 is the cleanest.
Confirmed with support (Sept 2026): renewal can fail behind a proxy · domains are re-checked after setup and that re-check can fail even when initial verification passed · the origin forces HTTPS · same behaviour for root and subdomains · the configuration is not supported.
Happy to test any of this against a real setup — we have it running today and it will break at renewal, so we'd know quickly whether a fix works.