HTTPS for QR codes on your own domain: how the certificate is created

Almost every phone now opens scanned addresses with https. For that to work without a warning, the address needs a valid certificate for exactly that name. If the QR code contains qr.yourcompany.com, there has to be a certificate for qr.yourcompany.com.

Who issues the certificate

Certificates are issued by certificate authorities, many of them free and automatic. Before issuing, they check whether the applicant really controls the domain. For QR codes on your own subdomain, the service makes that request. It can pass the check as soon as your CNAME points to it.

How it works in practice

• You point your subdomain’s CNAME to the service.
• The service notices the record and requests the certificate.
• The certificate authority checks and issues it, usually within a few minutes.
• The certificate is renewed automatically before it expires, as long as the CNAME stays in place.

What warnings mean

• “Your connection is not private” right after switching: the certificate is not ready yet. Wait a few minutes.
• A warning showing someone else’s name in the certificate: the DNS record still points elsewhere, for example to the old provider.
• A warning after months: the CNAME was changed or deleted, so the certificate could not be renewed.

That is why you test before printing

Only scan a new code once the dashboard says “Active”, and do so with at least one iPhone and one Android phone. If the destination opens without a warning, the certificate is fine too. At Same-QR you see the certificate status in the “Own domain” window, including Cloudflare’s message if something is stuck.

Frequently asked questions