42

SSL certificates need to be installed in the server config, so for "typical web hosting" your hosting provider can easily restrict your ability to add your own certs (and even generating these without their support can be frustrating.) You should ask your provider if they can enable a free LetsEncrypt cert for you (they can be free and there are ...


12

Some hosting companies require that you pay them for their SSL certificates. It is not always possible to install a certificate from a third party. That being said, such a host is rare. Most hosting companies use cPanel or WHM to manage sites which support importing any certificate you want. The majority of web hosting companies will automatically get ...


7

Depending on your use case, one quick way of making a site SSL enabled would be to put it behind Cloudflare and use one of their free certificates. If you can get your web host to install a certificate they also provide free origin certificates, but even if your webhost only supports their own certificates this set up would get you SSL between the browser ...


3

Moving to a system using acme (or DNS if your systems have the hooks) and using Letsencrypt will likely the way to go. Certbot makes this easy. Total cost for certs is your time setting it up as a one off - no ongoing costs or manual cert installs and wide acceptance. Letsencrypt/Certbot doing ACME challenges is the way to go, is viable for 1 cert upwards - ...


3

There is a rule adopted in 2012 by the CA/Browser Forum that prohibits certificate authorities from issuing SSL certs for internal names. All certificates for internal names issued beforehand were deprecated and expired before 2015. At this point it is not possible to get a certificate for a local private domain. This rule covers several cases (reference ...


3

I never got the hooks to work. Instead I run the certbot renewal and then test if the latest certs are currently installed by downloading the cert from the live site and comparing it to the version locally stored by certbot. At first I was annoyed by this, but it turns out that this is a superior approach anyway. In some cases the cert can renew, but the ...


3

Cloudflare is a free solution for redirecting your alternate domains with HTTPS support. Here are detailed instructions for setting it up: Visit Cloudflare Create an account and verify your email address Use the "add a site" feature to add your alternate domain under their free plan. If you are creating an account, it should ask you to do this as a step ...


2

If you have to do manual work with certbot, you aren't doing it right. Certbot is designed to be automated. Introducing anything manual into the process isn't a good idea. Having to perform a manual task every 3 months is easy to mess up or forget. At some point your certificate is going to expire and your visitors to your site will get errors. You don'...


2

I've never heard any mention from Google that EV certs affect ranking compared to DV certs, and the only material I can find about it online is people who also say that Google has never mentioned this, and people who are speculatively guessing one way or the other. So here's my own speculative guess: I would be incredibly surprised, if after Google stopped ...


2

On May 18th you changed your nameservers from: ns10.nationbuilder.com ns11.nationbuilder.com ns12.nationbuilder.com ns13.nationbuilder.com ns14.nationbuilder.com ns15.nationbuilder.com to: ns41.domaincontrol.com ns42.domaincontrol.com Old nameservers resolve your name as: ;; ANSWER SECTION: davidkim2020.com. 2h40m IN A 96.45.82.241 davidkim2020.com. ...


2

As NuTTyX as said your name is in the SAN section. You can see it quickly that way: $ openssl s_client -connect copyurls.ml:443 -servername copyurls.ml -showcerts </dev/null |& grep -A100 'BEGIN CERTIFICATE' | grep -B100 'END CERTIFICATE' | openssl x509 -text -noout |& grep -A1 'X509v3 Subject Alternative Name' X509v3 Subject ...


2

Anyway, my question is, if specifying CAA for both the domain and www subdomain makes sense? Not necessarily except if you really need that. Why? Because CAA records cascade. Per RFC 8659 section 3, if a system has to find out a CAA record for www.example.com, it tries this name first, and if no response found, it continues "climbing up the root" ...


1

A certificate has to be installed on every web server hosting content for the domain. The wildcard certificate you obtain and install on your server will only cover subdomains hosted on your server. If your client has a subdomain hosted by a third party, that third party would need their own certificate. The dev subdomain doesn't have to have a wildcard ...


1

It is impossible to redirect HTTPS without a certificate. You cannot redirect with via DNS alone. Even a CNAME record, which is a type of alias, is not a redirect. A CNAME simply says that all requests go to the same IP address as the specified domain name. It is up to the server how to handle those requests. It is the job of the web server to issue ...


1

Found the reason on the Apple website: https://support.apple.com/en-us/HT210176 The reason is not the CA, but the certificate itself: Additionally, all TLS server certificates issued after July 1, 2019 (as indicated in the NotBefore field of the certificate) must follow these guidelines: TLS server certificates must contain an ExtendedKeyUsage (EKU) ...


1

If you have explained your co-workers assertions correctly, he is incorrect. CSR's do relate to a single set of certificates and do not affect your ability to create other certs with other CSR. A CSR is a signing request, and they are not really time critical - indeed for the most part any date/validity period in a CSR is ignored. The important parts are ...


1

It sounds to me very much like you have not enabled and configured NGINX to listen on port 443 (and I'm guessing you have not told it where to find the certs either). https://nginx.org/en/docs/http/configuring_https_servers.html tells you how to configure https - to summarise - typically add something like the following to your NGINX config file - server { ...


1

Certificates can be issued for "Subject Alternative Names" (that is, more names that certificate is valid for) which covers your hostname (I've just checked that it covers both your domain and any subdomain). Also, consider that when you censor your browser's navigation bar, the title of the tab still shows the domain name and should be censored as ...


Only top voted, non community-wiki answers of a minimum length are eligible