iFastHostingHow to manage SSL certificates in your control panel
Checking the SSL certificate on a domain, and what to do if one needs installing or renewing.
An SSL certificate is what lets a browser connect to your site over HTTPS rather than plain HTTP, encrypting the connection and showing a padlock rather than a "not secure" warning. Hosting includes a free certificate, and your control panel is where you check its status, install or reissue one, and confirm a domain is properly covered.
Checking your current status
Open the section of your control panel dealing with SSL, sometimes grouped under general security settings. Select the domain you want to check, and it should show whether a valid certificate is currently active, along with basic detail such as which domain names it covers and roughly when it is due to renew.
A certificate issued for your main domain does not automatically cover a subdomain unless it was specifically issued to, such as a wildcard certificate that covers any subdomain by design. If you have added a new subdomain, check its SSL status separately rather than assuming it inherited coverage from the main domain.
The free certificate included with your hosting
Free SSL is included with your hosting, and for most accounts it is issued and kept renewed automatically without you needing to do anything, provided the domain is correctly set up to point at this hosting account. If your control panel shows no active certificate for a domain that should have one, it is usually because the domain was only just pointed here, or a DNS issue is preventing the automatic verification the certificate relies on — resolving the DNS is generally the fix, rather than anything wrong with the certificate process itself.
Installing or reissuing a certificate manually
If a domain shows no certificate, or an existing one needs reissuing — after a change to which subdomains it should cover, for instance — the SSL section of your control panel should offer an option to issue or reissue one directly for the free certificate. This generally completes within a few minutes, though it depends on the domain's DNS already being correctly pointed at this hosting account, since certificate issuance verifies that ownership as part of the process.
Certificate issuance for a domain generally requires that domain to already be resolving to this hosting account. If you have just added a domain and DNS has not finished updating yet, wait for that to settle before troubleshooting SSL — an unissued certificate at this stage is very often just DNS catching up, not a separate problem.
Uploading a certificate you bought elsewhere
If you have purchased a certificate from a third-party provider rather than using the included free one — sometimes done for a specific type of certificate such as extended validation — your control panel's SSL section should also offer a way to install your own certificate, typically asking for the certificate file, its private key, and any intermediate certificate chain the issuer provided. Keep the private key secure and do not share it; anyone holding it could impersonate your domain's secure connection.
Confirming it is actually working
Visit your site with https:// explicitly in front of the address and check for a padlock with no warning in the address bar. If you see a warning, an online SSL checker tool can usually tell you more specifically what is wrong — a mismatched domain name on the certificate, an expired certificate, or an incomplete certificate chain are the common causes.
Making sure visitors actually use the secure version
Having a valid certificate installed does not by itself stop visitors reaching the plain HTTP version of your site — a certificate makes HTTPS available, it does not require it. To make sure every visitor ends up on the secure version regardless of which one they originally typed or clicked, you need to force HTTPS site-wide, typically with a redirect rule. See how to force HTTPS on your website for how to set that up.
If your site still shows "Not secure"
- Check the certificate actually covers the address being visited, including whether it is the
wwwor non-wwwversion, since a certificate can be valid for one and not the other if not configured for both. - Check for mixed content. A page loaded over HTTPS that still pulls in an image, script or stylesheet over plain HTTP can trigger a browser warning even with a perfectly valid certificate. See how to fix mixed content warnings.
- Check the certificate has not expired, particularly if you installed a third-party certificate manually rather than relying on the included free one, since manual certificates are not renewed automatically the way the free one is.
If you are still deciding whether you need SSL at all for a particular site, the short answer is yes — see do I need an SSL certificate for the reasoning, though on our hosting the free certificate makes the decision largely moot in practice.
Related reading
The padlock explained plainly: what a certificate actually verifies, what it encrypts, and the questions it was never built to answer.
How to force HTTPS on your websiteA certificate being installed does not redirect anyone by itself. Here is the rule that sends every visitor to the secure version automatically.
Do I need an SSL certificate?Yes, every site needs one now, including a small brochure site with no forms — here is what changes if you skip it.
A tour of your hosting control panelThe main sections you will find in your control panel and roughly what lives in each one.