Free TLS certificates and HTTPS

HTTPS is no longer optional. Browsers label plain HTTP as "Not secure", search engines rank it lower, and any login or payment over it is genuinely unsafe.

How it works here

We use certificates from Let's Encrypt (free, automated, widely trusted) issued and renewed by Certbot. When you attach a domain to a site, we can request a certificate automatically and renew it before it expires. You never pay, and you never have to remember.

Issue a certificate

1. Make sure the domain's DNS already points at us — the certificate authority validates that you control the name, which it can only do if the name resolves here.

2. In /panel/web, open the site, choose SSL/TLS, and add the domain.

3. We request the certificate and install it. This usually takes seconds.

Both example.com and www.example.com should be requested so neither shows a warning.

Renewal

Renewals are automatic. You can confirm the schedule in the panel, and check the expiry date any time:

echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -subject -dates

If a renewal fails it is almost always because the domain stopped resolving to us (DNS changed), port 80 is blocked (the validator needs it), or a rate limit was hit after repeated failures. Fix the cause, then retry manually.

Redirect HTTP to HTTPS

A certificate alone does not stop people reaching the plain-HTTP version. Add a permanent redirect — see Forcing HTTPS and redirects. Once in place, every visitor lands on the secure version even if they type http://.

Test it properly

curl -I http://example.com      # should be a 301 to https://
curl -I https://example.com     # should be 200

And check for mixed content: a page served over HTTPS that loads an image or script over plain HTTP is marked insecure by browsers. Load everything from https:// URLs.

Behind a proxy or CDN

If you put a CDN in front of us, the certificate chain runs CDN → visitor AND CDN → origin. Both legs need certificates. Our side issues for the origin; the CDN issues for the visitor-facing name. See What is a CDN and do you need one?.

Related reading

• Pointing your domain at HostingSwift

• Forcing HTTPS and redirects