Free SSL on Linux hosting: HTTPS, Force HTTPS and HSTS

Your site should load over HTTPS, and every Linux hosting plan includes a free certificate for it. Every site answers over modern encrypted connections, with nothing for you to set. You manage certificates in the SSL tab of your service page.

Before you start

The A records of example.com and www.example.com point to the Server IP address shown on Overview; see point a domain to your server.

Step 1: Get the free certificate

Free Let's Encrypt certificates are issued as soon as the domain points to the server and renewed by themselves before they expire, so usually there is nothing to do. To get one at once:

1. Open SSL. The list shows each of your domains with its State, its Expires date and the Names its certificate covers.
2. Select Issue Free next to the domain. If the domain already has a certificate, confirm that the new free one replaces it; the site keeps running.
3. It can take a moment. Open the tab again to see the result: the State becomes Free Certificate, and Names lists the domain and its www name.

The State column can also show Waiting (the free certificate is not issued yet, usually because the domain does not point to the server), Expires Soon, Expired, Own Certificate for one you uploaded, and No Certificate.

Verify: https://example.com and https://www.example.com load with a padlock.

Step 2: Send every visitor to HTTPS

Two switches in each domain's row decide how browsers reach the site:

• Force HTTPS sends every http:// request to https:// for the names the certificate covers. It is on by default and acts only while the domain has a certificate.
• HSTS tells browsers to use only HTTPS for your domain from then on. It is off by default. When you turn it on, confirm with Turn On HSTS: browsers then refuse plain HTTP for this domain for a long time, even if you remove the certificate later. Turn it on only when every page works over HTTPS.

To set how long HSTS lasts, open Websites, select Settings next to the site and go to the HTTPS section: HSTS lasts (days) takes 1 to 730 days, and HSTS covers subdomains too extends it to every subdomain of the domain. Select Save Settings and confirm with Save And Restart.

Verify: http://example.com opens as https://example.com.

Step 3: Upload your own certificate (optional)

If you bought a certificate, use it instead of the free one:

1. In the domain's menu, select Upload Certificate.
2. Choose the Format:
   • PFX File: choose the PFX file and enter the PFX password.
   • PEM Text: paste the Certificate (PEM) and the Private key (PEM).
3. Select Upload Certificate. It takes the place of the current certificate, and its State becomes Own Certificate.

A certificate you upload is not renewed for you: upload the new one before it expires, or select Issue Free to go back to the free certificate.

Verify: https://example.com shows your certificate when you open its details in the browser.

To take a certificate away, select Remove Certificate in the same menu. The site stops answering over HTTPS until a new certificate is installed.

Troubleshooting

An error appears under the domain. The domain or its www name does not point to the server yet, or the change has not reached the whole internet. Check the A records, wait a while and select Issue Free again.

The padlock is missing on some pages. Those pages still load images or scripts over http://. Change those addresses to https:// in your site.

Next steps

• Your site's files: upload files on Linux hosting.
• More domains on the same service: domains, PHP and .htaccess on Linux hosting.