SSL Management for Branded Domains in Beehiiv: An Overview

Is SSL handled by Beehiiv (for branded, not .beehiiv.com domains), or in DNS? Having an occasional issue with some users, and trying to pinpoint it.