Add a custom domain to a Fly app and obtain TLS certificates via DNS validation or TLS-ALPN challenge.

Documented steps

1. Run fly certs add example.com (or fly certs add *.example.com for wildcard; quote to prevent shell expansion)
2. Choose DNS validation method: A record, AAAA record, CNAME record, or DNS _acme-challenge CNAME for wildcards
3. Allocate IP addresses if needed: fly ips allocate (IPv4) or fly ips allocate-v6 (IPv6)
4. For A/AAAA records, point your domain to the IP addresses shown in fly certs setup <hostname> output
5. For CNAME records, point subdomain (e.g., www.example.com) to your app's .fly.dev hostname; avoid CNAME at apex unless DNS provider supports CNAME flattening
6. For wildcard certificates, set _acme-challenge CNAME record as shown in certificate details
7. Fly validates ownership via TLS-ALPN (preferred), HTTP-01, or DNS-01 (manual) challenges—platform automatically attempts validation
8. Check certificate status: fly certs check <hostname> (shows validation status and issued certificate types: RSA and/or ECDSA)
9. View all verification options: fly certs setup <hostname> (displays DNS records and validation instructions)
10. Docs: https://fly.io/docs/networking/custom-domain/