Title: Custom TLS certificate requirements
Author: WordPress VIP Documentation
Published: October 4, 2023
Last modified: June 10, 2025

---

 1. [TLS](https://docs.wpvip.com/tls/)
 2. [Install a custom TLS certificate](https://docs.wpvip.com/tls/custom-cert/)
 3. Custom TLS certificate requirements

#  Custom TLS certificate requirements

A generated custom TLS certificate must meet all of the following requirements in
order to be successfully installed:

 * Certificates must include both “www” and the root version of a hostname. A SAN
   or wildcard certificate is recommended for this purpose.
 * The maximum certificate length that can be accepted by VIP is 398 days.
 * Certificates must be in [PEM format](https://www.ssl.com/guide/pem-der-crt-and-cer-x-509-encodings-and-conversions/).
 * The certificate chain must include one or more trusted certificates (also known
   as “[Intermediate certificates](https://letsencrypt.org/docs/glossary/)“) provided
   by a Certificate Authority (CA).
 * Trusted certificates are publicly available. If a trusted certificate is missing
   from a certificate chain, it can be retrieved from online tools such as [KeyCDN](https://tools.keycdn.com/certificate-chain).
 * [Online Certificate Status Protocol (OCSP) stapling](https://en.wikipedia.org/wiki/OCSP_stapling)
   is not supported and should not be used. Custom TLS certificates that include
   OCSP Must-Staple will not be considered valid by TLS clients.
 * A custom TLS certificate can be generated and installed before a [domain has been verified](https://docs.wpvip.com/domains/verification/)
   and before the [DNS for a domain is pointed to VIP](https://docs.wpvip.com/point-dns-to-vip/).

Last updated: June 10, 2025