9

I want to be able to host HTTPS in addition to HTTP and I thought I could simply buy a low cost SSL certificate and copy the certificate to my hosted website?

But my service provider has a variety of SSL purchase options where you have to pay a monthly or annual fee and the amounts are not negligible. Should I buy through them? Can they restrict me from doing a DIY job?

Improve this question
6
  • 2
    There’s no generic answer to this. It entirely depends on the exact technical and contractual arrangements that you have with your web host.
    – Mike Scott
    Commented Feb 4, 2021 at 17:59
  • 1
    It might help to tell us which host you use, and how you access the backend (e.g SSH, cPanel), because sometimes there are workarounds. For example, I use GoDaddy, which doesn't support third-party certificates, yet I use the free Let's Encrypt on all of my websites.
    – Paddy Landau
    Commented Feb 4, 2021 at 20:58
  • 4
    "in addition to"? I'd urge you to reconsider providing insecure access to your site if at all possible. Unless you have a non-trivial amount of users that do not have any way to access your site using modern security protocols, providing an insecure version of your site is only going to lead to your nontechnical users seeing security warnings in modern browsers and potentially being scared to use it.
    – Nzall
    Commented Feb 5, 2021 at 9:33
  • I have a few websites on shared hosting and they all have free SSL certificates. I didn't ask for any of them and they seemed to be installed during a cPanel update. If you have cPanel check the security section.
    – Bonzo
    Commented Feb 5, 2021 at 12:42
  • 1
    Hosting an http website is, imo, an unprofessional look. Even if you support both, people will somehow find a way to link the http:// version around the internet. There's no reason not to redirect http to https, not to mention the couple security-wise benefits that exist.
    – Carson Graham
    Commented Feb 6, 2021 at 5:48

4 Answers 4

Reset to default
42

SSL certificates need to be installed in the server config, so for "typical web hosting" your hosting provider can easily restrict your ability to add your own certs (and even generating these without their support can be frustrating.)

You should ask your provider if they can enable a free LetsEncrypt cert for you (they can be free and there are standardised systems to automate this,) and if not shift to a provider that is not cynically trying to extort money for what is now considered a standard best practice.

Improve this answer
6
  • 19
    +1 Take your business elsewhere if needed. There are plenty of quality web hosting providers that support LetsEncrypt.
    – Amazon Dies In Darkness
    Commented Feb 5, 2021 at 9:36
  • 3
    There are more free certificate authorities than only letsencrypt. ZeroSSL and BuyPass for example.
    – jornane
    Commented Feb 5, 2021 at 16:22
  • 3
    I'll note that there are 3 levels of provider: 1) Providers that will help you (or automate) installing a free cert. 2) Providers that will help you, but only if you're installing a paid cert. 3) Providers that will block you from installing a free cert. I'll note that providers of type 2 and 3 often respond to support requests the same way, so investigating this yourself may serve you better than asking support for help.
    – Brian
    Commented Feb 5, 2021 at 22:28
  • Worth mentioning that some free certificate providers such as ZeroSSL currently allow certificates for only three domains and then for only 90 days, so that every three months you must renew.
    – andrewbuilder
    Commented Feb 6, 2021 at 23:55
  • 2
    @andrewbuilder Conceptually, that sounds a lot like letsencrypt, where the short validity period is a key to nudge you into automating renewal (instead of panicking after two years). Don't ZeroSSL perhaps offer some kind of automation as well?
    – Hagen von Eitzen
    Commented Feb 7, 2021 at 13:20
12

Some hosting companies require that you pay them for their SSL certificates. It is not always possible to install a certificate from a third party.

That being said, such a host is rare. Most hosting companies use cPanel or WHM to manage sites which support importing any certificate you want. The majority of web hosting companies will automatically get free SSL certificates from LetsEncrypt for you and keep them updated every couple months.

If your web host doesn't offer free certificates or allow you to import a certificate you can:

  • Complain to their customer support
  • Write a bad review of their hosting services
  • Move your website to hosting company that will allow you to import certificates
Improve this answer
3
  • 3
    "95% of all web hosting companies allow your to import any certificate you want" - For a regular shared hosting webspace? I'd say 95% of hosting companies do not allow to import custom certs in that scenario, at least from my experience over the last >5+ years in central europe
    – kero
    Commented Feb 5, 2021 at 12:04
  • 4
    Most shared hosting uses cPanel or WHM, both of which support that feature. See How to transfer an SSL certificate from one cPanel account to another? Do I need to transfer it? I have WHM with the new account for example. I did make up the 95% number though, it could be high. I removed that stat from my answer and replaced it with just "most."
    – Stephen Ostermiller ♦
    Commented Feb 5, 2021 at 12:40
  • @StephenOstermiller It's worth bearing in mind that using WHM or cPanel does not oblige a host to enable all its features. If they are extra keen to make money as a certificate reseller, rather than just being too lazy to implement a better option, they could simply turn off that module, and oblige you to use their custom system to order a certificate with a markup.
    – IMSoP
    Commented Feb 5, 2021 at 20:15
7

Depending on your use case, one quick way of making a site SSL enabled would be to put it behind Cloudflare and use one of their free certificates. If you can get your web host to install a certificate they also provide free origin certificates, but even if your webhost only supports their own certificates this set up would get you SSL between the browser and Cloudflare - which wouldn't be acceptable for anything requiring an "end-to-end" encrypted connection but might suit your use case.

Disclaimer - I have no affiliation with Cloudflare other than being a customer of theirs.

Improve this answer
4
  • I changed "fully encrypted" to "end-to-end" encrypted in your post as I suspect it more clearly expresses your thought??. think your observation of using a reverse proxy provider like Cloudflare is a useful observation. +1
    – davidgo
    Commented Feb 6, 2021 at 18:54
  • Just to be more clear to OP: CLOUDFLARE can see all of your traffic completely unencrypted. Either you use origin certificates or not.
    – Anunay
    Commented Feb 7, 2021 at 0:29
  • Wouldn't that defeat the purpose of an SSL certificate if a company you really don't know could Man-In-The-Middle your website at will?
    – 8vtwo
    Commented Feb 7, 2021 at 22:17
  • @8vtwo It depends on your threat model. Someone might not consider an issue that Cloudflare could MITM your connection (well, you are choosing to put them in the middle), just like your hosting could access anything sent there. Letting Cloudflare view the contents if they turned evil still seems better than letting anyone view the contents (note: the leg between Cloudflare and the hosting might still be cleartext).
    – Ángel
    Commented Feb 8, 2021 at 1:56
-2

Yes, you have to pay for an SSL certificate. Though you pay for it, it's really a worthier thing as it provides data encryption to your site contents. Of all other advantages, it makes your visitors feel safer. Normally positive SSL certificate costs around Rs. 1000 / Year and this may vary depending on the provider. Check with the various branded players for SSL price details.

Improve this answer
1
  • Most sites use free certificates these days, so paying far a certificate isn't required. This doesn't really answer the question about whether or not they can import a certificate at their particular hosting company.
    – Stephen Ostermiller ♦
    Commented Feb 22, 2021 at 15:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.