Why the certificate gap happens
Many managed WordPress hosts issue free certificates automatically, but the certificate authority has to confirm you control the domain first. The validation method decides whether that can happen before DNS points at the new host. If it cannot, the first minutes or hours after cutover can show certificate errors to members, and Stripe, which requires TLS v1.2 or higher with a valid certificate, can fail to deliver webhooks during that time.
For a membership site, a certificate warning on the login page is the worst possible first impression of a migration, and many members will not click through it. The goal is to have a certificate the new server will present for your real hostname before the DNS change, and to verify it.
Let's Encrypt challenge types and what they mean for cutover
Let's Encrypt documents three challenge types. The constraints relevant to a migration are summarised below.
- HTTP-01 and TLS-ALPN-01 tie validation to the server answering for the domain, which is the old host until cutover.
- DNS-01 ties validation to the DNS zone, so it can complete while traffic still goes to the old host.
| Challenge | Documented constraint | Before DNS cutover? |
|---|---|---|
| HTTP-01 | Can only be done on port 80; cannot issue wildcard certificates; only accepts redirects to http or https on ports 80 or 443 | Usually no: validation reaches whatever server DNS points to |
| DNS-01 | Can issue certificates containing wildcard domain names | Yes, if the host or you can publish the required DNS record |
| TLS-ALPN-01 | Performed via TLS on port 443; cannot validate wildcard domains | Usually no: validation reaches whatever server DNS points to |
What two managed hosts document
WP Engine says that when adding a certificate from Let's Encrypt, you should ensure DNS is pointed to WP Engine beforehand to prevent errors. It also says using a 3rd-party SSL allows you to secure the domain prior to DNS being pointed to WP Engine, and that the domain should be added in the User Portal before installing the certificate. WP Engine notes certificates typically install and activate within a few minutes, however in some cases can take up to 24 hours, which is a reason not to schedule the Let's Encrypt route right before a busy period.
Kinsta documents a verification-first method: a TXT record confirms you own the domain, and once your domain is verified, a free SSL certificate with wildcard support is automatically added. Kinsta describes this method as one that verifies domain ownership first, then points your domain, avoiding downtime, but taking longer overall. For Cloudflare domains, Kinsta says verification records must initially be set to DNS only. Kinsta's page does not state in so many words that the certificate is serving before DNS points at Kinsta, so confirm it with a direct test before cutover.
Test the certificate before you switch
WP Engine suggests that if you want to test the SSL before pointing DNS you can emulate DNS locally with the hosts file trick. A curl --resolve command does the same thing for one request without editing system files, and keeps normal certificate verification on; the curl --resolve guide walks through it. A passing test shows the new server presents a certificate valid for your hostname. A failure tells you to wait, use the DNS-based route, or install a certificate yourself.
Check the www and apex hostnames separately, plus any subdomain that members use, such as a separate courses or members subdomain. A certificate that covers only one of them will produce errors on redirects between them.
Decision guide
- Host offers DNS-based or verification-first issuance: complete it days before cutover, then test with curl
--resolve. - Host only issues after DNS points there: schedule the cutover in a quiet period, keep the old site serving, and expect a short gap; or install a purchased certificate in advance where the host supports it.
- Cloudflare in front of the site: follow the new host's Cloudflare instructions; Kinsta, for example, says its verification records must start as DNS only.
- Never test with certificate checks turned off; a certificate error in a preflight is the signal you need.
Questions before you decide
Why can't my new host issue a Let's Encrypt certificate before I change DNS?
If it uses the HTTP-01 challenge, Let's Encrypt validates over port 80 on the server the domain currently resolves to, which is the old host until cutover. A DNS-01 challenge or a third-party certificate avoids that dependency.
Does WP Engine let me install a certificate before DNS?
WP Engine says a third-party certificate allows you to secure the domain prior to DNS being pointed, after adding the domain in the User Portal. For Let's Encrypt, it says to point DNS first.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Let's Encrypt: Challenge Types Accessed 13 Oct 2026
- WP Engine: How to Secure a Website with SSL Accessed 13 Oct 2026
- Kinsta Docs: Add a Domain Accessed 13 Oct 2026
- Stripe Docs: Receive Stripe events in your webhook endpoint Accessed 13 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.