A certificate makes your website open with https:// and a padlock in the browser. Browsers warn visitors about sites without it, and search engines rank them lower.
Free certificate (recommended)
- Make sure the domain points to us (the A record and
www). The certificate can only be issued when it does. See Move your domain to us. - On the Websites page, choose Get free certificate next to the website.
- After about a minute the website shows Let's Encrypt and the date the certificate runs until.
The free certificates come from Let's Encrypt. They cover the domain, www. and any aliases, and are renewed automatically well before they expire. You do not need to do anything.
If the certificate cannot be issued, the Activity page shows why. The most common reason is that the domain or www still points to another server.
Send visitors to HTTPS
Under Settings for the website:
- Send visitors to HTTPS sends everyone who types
http://to the secure address. Keep it on. - Tell browsers to always use HTTPS (HSTS) makes browsers remember to use HTTPS for a year. Only switch it on when HTTPS works for the domain and all subdomains, because browsers keep the rule even if you remove the certificate.
Your own certificate
If you bought a certificate, for example an EV or wildcard certificate:
- Choose Upload own next to the website.
- Paste the certificate with the intermediate certificates below it (all
-----BEGIN CERTIFICATE-----blocks, yours first). - Paste the private key (
-----BEGIN PRIVATE KEY-----). It must not have a password. - Choose Install certificate.
The panel checks that the key matches the certificate, that it has not expired, and tells you which of the website's names it does not cover. A certificate you upload is not renewed automatically: upload the new one before it expires. We remind you by e-mail two weeks before. You can go back to the free certificate at any time with Use free certificate.
Our DNS zones contain a CAA record that only allows Let's Encrypt to issue certificates for your domain. If you buy a certificate elsewhere, add a CAA record for that provider on the DNS page first, or ask us to.