Enable SSL on web hosting

An SSL certificate encrypts the connection between browser and server. On web hosting, Let's Encrypt is the standard method: free, automated and renewed by the panel. DNS must be ready, and the site must stop loading resources over HTTP.

1. Check prerequisites

Before requesting a certificate:

• the domain points to the hosting with an A record and, if applicable, AAAA;
• DNS propagation is complete;
• the domain exists in KeyHelp;
• port 80 is reachable for HTTP-01 validation;
• no CAA record forbids letsencrypt.org.

dig +short A your-domain.tld
dig +short AAAA your-domain.tld
curl -I http://your-domain.tld/

If the domain sits behind a third-party proxy, validation may fail: read the proxy documentation before retrying.

2. Issue the certificate

In KeyHelp, open the domain and the SSL/TLS section. Choose Let's Encrypt, select the domain and its aliases (www included if used), then start issuance.

Validation fetches a temporary file over HTTP. A failure usually means wrong DNS, a closed port 80, or an aggressive redirect intercepting the validation path. Fix that first, then retry.

3. Redirect to HTTPS

Once the certificate is active, force HTTPS. KeyHelp may offer the option; otherwise, with Apache, add to .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Test with R=302 first to avoid a stubborn browser cache if something is wrong. Do not create a loop: behind a TLS-terminating proxy, %{HTTPS} may stay off and the rule loops.

4. Fix mixed content

An HTTPS page loading an image, script or stylesheet over HTTP triggers a warning, and some browsers block the resource. Use relative URLs or https://, then check the browser console.

For a CMS, absolute URLs are often stored in the database: update them after the switch. Watch imported content from an old site, which may keep hard-coded http:// links.

5. Renewal and verification

Let's Encrypt issues short-lived certificates. KeyHelp handles their renewal; still check the expiry date:

openssl s_client -connect your-domain.tld:443 \
  -servername your-domain.tld </dev/null 2>/dev/null \
  | openssl x509 -noout -dates

Also confirm:

• curl -I http://your-domain.tld/ returns a 301 redirect to HTTPS;
• curl -I https://your-domain.tld/ returns 200;
• the certificate chain is complete in the browser;
• no forgotten subdomain still uses HTTP.

Renewal often fails because DNS changed or port 80 was closed: watch the expiry date instead of waiting for visitors to report it.