SSL certificates for websites

An SSL certificate encrypts the connection between a browser and a website and enables HTTPS access.

Yes. HTTPS protects data in transit and is expected by browsers, users and many online services.

Let’s Encrypt is often enough for a website with automatic renewal. Paid SSL can be more convenient for manual installation, closed systems, IoT devices and Wildcard coverage.

Choose a standard certificate when you need to protect one main domain and its regular www version.

Wildcard is useful when one certificate must cover the main domain and its first-level subdomains.

A CSR is a certificate request: a block of text with the domain and a public key that the certificate authority asks for when you order. A private key is created along with it. It stays with you and is needed for installation.

If the certificate is going onto hosting, it is easiest to create the CSR in the panel: cPanel, DirectAdmin and Plesk do this in their SSL section. For a device or a server without a panel, use our CSR generator: the key is created in your browser and never reaches us.

The certificate authority offers three ways to choose from: an email to an administrative address in your domain, a file you place on the site, or a record in the domain's DNS zone. Any of them proves that the domain is under your control.

The DNS record is usually the easiest: it does not depend on whether the site is already running or the mail is set up. If we host the domain's DNS zone, support will add the record on your request.

Count from the domain verification, not from the payment: until the certificate authority is satisfied that the domain is yours, nothing is issued. Once it is verified, the files arrive within minutes.

Almost every delay here is an email that never reached the administrative address in the domain. If you are waiting longer, check the domain's mail or switch to verification through DNS.

We issue the certificate files; installation is on your side. The files are loaded into the site control panel, into the web server, or into the device the certificate was ordered for. If it is not obvious where exactly, write to support and we will advise for your panel or server.

After installing, run the address through our SSL certificate checker: it shows whether the server sends the intermediate certificate and whether browsers trust the certificate.

Often yes, if the device supports the certificate format, private key and trusted chain. Check the device requirements before ordering.

Yes. A certificate is a set of files, not a binding to a machine: it can sit on the website, the mail server and the load balancer at once, as long as they all answer to the same domain name. The private key travels to each server along with it, so keep it as carefully as a password.

It stays valid for the old name and will not work for the new one: a certificate authority issues a certificate to a specific name. A new domain needs a new certificate.

For the same reason, a subdomain that is not in the certificate will be flagged as insecure by the browser. If subdomains come and go, take Wildcard: it covers the domain and its subdomains at once.

Order a new file and install it in place of the old one. You verify ownership of the domain again, the same way as the first time.

This is not the same as renewing the service: the service is paid for a year, while a single file is valid for less, so within that year the file changes more than once. Why it works that way is explained in the section on reissues on this page.

The client area issues a European-format invoice, and a closing document is available once it is paid. The tax depends on who is buying: EU companies with a VAT number fall under reverse charge, outside the EU it is 0%, and EU private individuals pay their own country's rate. It is all set out on the payment and documents page.