84

Why should I pay for an SSL certificate? For most uses, there's no good reason to pay for them. See the very bottom for a summary of the exceptions. Let's take a step back and explain what certificates do and roughly how. What are commonly called "certificates" consist of two linked pieces: The certificate proper, which contains a public key and some ...


7

Let's Encrypt is superior in many ways, including the ones that you have mentioned, such as: It's free. Hard to get past that. It has automatic renewal (I'm sure it's not JUST exclusive with Let's Encrypt, however) It's pretty easy to set up. Google and many others support it as a trusted CA, which is a huge deal when it comes to SEO and security. However, ...


4

LetsEncrypt certificates are great. I use them myself instead of buying certificates. There are a few drawbacks: LetsEncrypt certificates only last 3 months. Most purchased certificates are good for one or two years. That means that you absolutely need an automated process in place to renew your certificates or it is going to be too easy to forget. ...


3

It's a security measure. If such things hung around forever, it would give crackers more time to obtain the cert surreptitiously. This way, there is an ongoing check to make sure the cert is still in use by a real person or other entity.


3

Here's what worked for me and many other people on Cloudflare's support forums: In your Cloudflare account, go to the bottom of the Crypto section and click Disable Universal SSL. Wait ten minutes and then click Enable Universal SSL. Wait another ten minutes or so and your Universal SSL status should change to "Active Certificate".


2

If you have an HTTP redirection from one URL to another, the browser has to connect to first URL, negotiate TLS if using HTTPS, and then only get back answer from the webserver with a location header to learn the new URL. Which means in turn that if the browser has to contact the first URL it needs to compelete the TLS handshake fully hence it needs an ...


2

When you use cloudflare there are two connections to your website because Cloudflare acts as a proxy in the middle: User ------> Cloudflare ------> Origin (cPanel) Cloudflare will enable SSL between the user and Cloudflare but may leave the connection to the origin unencrypted: User ======> Cloudflare ------> Origin If ...


2

At this point in time, Get Started with Let's Encrypt. You can specify multiple domains on one certificate. certbot -d domain1,domain2 ... If by contrast you want to serve different certs for the different domains on your server, configure server software to use TLS Server Name Indicator (SNI) Extension. Differing Certificate types don't have much value ...


2

There is no reason not to do it. If you go read your emails through webmail.example.com do you want anyone to be able to read them also, and maybe change them in the path? If not, you need HTTPS, and hence you need a certificate (either specifically for webmail.example.com or a wildcard one of *.example.com). Browsers are more and more leaning towards ...


2

The problem was that I forgot updating website bindings in IIS. I have set up the port 443 to https for old SSL and I thought it is enough. But when you add a new certificate, you have to edit those website bindings again and point to the new certificate in the settings.


2

An X.509 certificate (not SSL certificate that everyone talks about, SSL is dead since 20 years, and certificates can be used outside of the TLS world, and TLS can be done without certificates also) can describe (authenticate) various different entities: a domain name, an individual, an organization, an email, an IP address, etc. It can also be issued ...


2

Secure Domain Space TLD's are encrypted at the domain level using HSTS. Theoretically you would still be able to connect to it for gaming, but hosted websites will be encrypted by default. HTTP Strict Transport Security (HSTS) is a web security policy mechanism that helps to protect websites against protocol downgrade attacks1 and cookie hijacking. ...


2

I found my mistake. Instead of putting in DOMAIN 60 IN TXT "TOKEN" I needed to put in @ 60 IN TXT "TOKEN"


2

Update: My experience was weird and defied all expectations. I was checking the certificate that was being served right up until about 10 seconds before the expiration date, using a variety of applications and devices (curl, Firefox, Safari, Chrome, an iOS app). All of them indicated that certificate expiry was imminent. But when I checked again, the ...


2

Your DNS has two IP addresses specified for your site. Only one of the two has a server with properly configured security certificates. When you have two A records for the same host name, it is known as "round robin" DNS. Clients will randomly try to connect to one or the other. Some modern browsers may try both of them to see which works, which may be ...


2

I would say this depends on what is going on the website along with your ability to implement the solution, also whether you have subdomains. Gauging by your question, you seem to have the ability to do any of the solutions. Your websites content. I would suggest using a paid SSL if you are an e-commerce site or is a multi-site. Mainly due to the warranty ...


2

HTTP redirects happen AFTER the TLS handshake. For the TLS handshake to be successful, the server has to present a valid certificate, having in it the hostname that is in the URL being accessed, otherwise browsers will show errors. So the rule is simple: as soon as you see an https:// URL, even if all accesses to it are finally redirected to another URL, ...


1

What does "Secure domain space" mean technically? Nothing specially, as this is not a technical specification. Here is what happens. 1) HSTS is a new standard, implemented by many browsers, that prohibits them to connect over HTTP and force HTTPS. This either happens after the first connection through HTTP (the server replies with some headers dictating ...


1

If you don't have to ask users to send some personal info and don't have online payment function, then you don't need Full (strict) certificate. Full SSL As it should be evident by now, Full SSL will mean a completely secure connection. You will have a fully secure connection between your visitor and CloudFlare and also a secure connection between your web ...


1

You use NS records to connect your domain name registrar to your DNS host. You use A and CNAME records to at your DNS host to connect your domain name to the IP address of your web host. You could have: Domain.com -> NS ns1.hostinger.com -> A 1.1.1.1 Or you could have: Domain.com -> NS ns1.domain.com -> A 1.1.1.1 In this case both your ...


1

It does appear that your server is blocking access by bot sites such as the Open Graph evaluation tools (the site can be access by Google bots such as the Google Structured Data testing tool, but not others). I tried it with the https://lyminhnhat.com/resources/productivity/corner-timer-gently-make-you-feel-guilty-on-time-wasting-apps/ address from your tag. ...


1

You should concatenate all (that is intermediate - but you may have one or more of them - and CA) certificates and put it in "certificate CA" field, while you put the server certificate in the "certificate" field. Note that the CA certificate ("root" certificate) is technically not needed in "certificate CA" field (which then introduces quite a misleading ...


1

If you're using Nginx, you could do something like this: server { listen 443 ssl http2; server_name www.example.com; include /etc/nginx/ssl-stuff.common; return 301 https://example.com$request_uri; } And server { listen 443 ssl http2; server_name example.com; include /etc/nginx/ssl-stuff.common; root /var/www/html; } With ssl-stuff....


Only top voted, non community-wiki answers of a minimum length are eligible