One workflow
Order, validation, issue, download and cancellation in one order.
Put a certificate on the site so the connection is encrypted and browsers stop warning about it.
A certificate encrypts the connection between your visitor and your server, and stops the browser labelling the site as not secure. The certificate is issued by a certificate authority; we take the order, the domain validation, the issue and the delivery, and you install it.
Without one, Chrome, Safari and Edge all say plainly that the site is unsafe. On any page that takes a form, a sign-up or a payment, that costs visitors immediately.
Choose the type and enter the domain it is for.
Approve by email or publish the DNS record; the accepted approver addresses are listed on the order.
Install the issued certificate on your own server.
Watch the expiry date and reissue ahead of it.
Order, validation, issue, download and cancellation in one order.
No guessing which mailbox the authority will accept.
Awaiting validation, issued or action required, at a glance.
Trigger the email again without contacting support.
Order, configure, query and cancel from your own tooling.
The issuing authority is set by the SSL module and can be changed.
Five steps, usually within a day
The certificate files include a private key. It belongs on the server that generated it; never send the private key to us or to anyone else.
The boundary, stated plainly
Our side is getting the certificate issued and delivered: order, validation, issue, download and cancellation. Installation happens on your server, hosting panel or load balancer.
That split exists for a reason: the private key should be generated and kept on your server, and we neither need nor want it. It also means that a certificate installed in the wrong place, HTTPS not redirected, or a move to a new server without reinstalling the certificate is something to fix on your side.
In a sensible order
| Symptom | Usual cause |
|---|---|
| Installed but still not secure | The page still loads some resources over http, or http is not redirected |
| Certificate does not match this domain | Issued for www and you are visiting the bare domain, or the reverse |
| Certificate has expired | Renewal was missed, or the old certificate is still installed |
| Incomplete certificate chain | The intermediate certificate was not installed alongside it |
| Only some pages warn | Those pages pull something from another domain that has no certificate |
A certificate does not renew itself
A certificate is a credential with a start and an end date. Once the end passes, every browser refuses to trust it - not because something broke, but because that is what a certificate is. Work from the expiry date on the order and reissue ahead of it.
Moving to a new server means installing the certificate there too. If the matching private key is not present, the certificate has to be reissued.
Order, validation state, issue and expiry together.
Accepted approver addresses listed, validation email resendable.
Certificate and intermediate once issued.
Cover several hostnames on one certificate where supported.
Start a cancellation from the order when appropriate.
Drive issuance from your own systems.
On your own server. We issue and deliver the certificate; we do not install it and we do not host your site.
It depends on how quickly it is completed. Once the authority sends its validation email, clicking the link usually means it is issued the same day; DNS validation needs the record to propagate, typically within hours.
Browsers go back to warning visitors. Note the expiry date on the order and reissue before it passes. Certificates do not auto-renew; that is a property of the certificate system, not a setting we can switch on.
Yes. It is configured in the SSL module in the admin area. New orders use the new authority; existing orders are unaffected.
It depends on the type. A single-domain certificate covers one. Types that support additional hostnames (SAN) can cover several on one certificate. The order page states the limit for the type you choose.
Check the order for the approver addresses the authority accepts, confirm one of them is a mailbox you actually receive at, then use the resend action. If it still does not arrive, use DNS validation or open a ticket.
Open the page for this service and finish in a few steps. If you would rather ask first, a ticket reaches a person.