SSL certificates and HTTPS at Nexthosting

In short

With web hosting and WordPress hosting, Nexthosting automatically issues a free Let’s Encrypt certificate for your domain. This only works once the domain already points to the server. If the certificate is still missing, the cause is almost always DNS. You can also use certificates of your own.

What is an SSL certificate?

A certificate makes sure your browser talks to your website in encrypted form (HTTPS, recognisable by the padlock in the address bar) and that the site really belongs to your domain. Technically it is called TLS today, but in everyday speech people still say SSL. Without a certificate, browsers warn about the site and many features (for example payment forms) do not work.

Automatic at Nexthosting

Let’s Encrypt is included automatically in every web hosting plan. You do not have to order, pay for or install anything. The certificate is requested as soon as your domain is entered for the website and points to the server, and it renews itself before it expires.

How your certificate comes about

1. ▶Enter the domain for the websitein the web panel
3. ?Does the domain point to the server?Check DNS
5. 3Let's Encrypt checks via httpIs a file reachable under your domain?
7. 4Certificate is issuedand activated on the server
9. ✓Website runs on httpsRenewal is automatic

The key point is the second step. Let’s Encrypt asks your domain from the outside: “Do you own this name?” To do so, it fetches a check file over http. If the domain still points to a different server, that server answers and issuance fails. This is not a bug but intentional, so that nobody can get certificates for other people’s domains.

Why is my certificate not there yet?

The page shows a certificate warning or only http. What is the cause?

The domain does not point to the server yetChange DNS and wait→

The DNS change is fresh (under 24 hours)Wait, the certificate follows once the name resolves→

Old AAAA records still point to another serverCheck or delete the AAAA record→

A redirect or block is stopping the check fileCheck .htaccess rules and protection services→

The most common causes:

Cause	Explanation	What to do
Domain not switched over yet	A/AAAA or nameservers point elsewhere	Connect a domain to your website
Just changed	DNS cache, TTL still running	Wait a few hours
Old AAAA record	IPv6 points to the old server; Let’s Encrypt tries IPv6 first	Delete or correct the AAAA record
www points nowhere	Certificate for www fails	Set a CNAME for www
Cloudflare proxy in front	The check does not reach the server as expected	Briefly switch off the proxy or use a Cloudflare certificate
Redirect forces everything to https	The check file is located under /.well-known/acme-challenge/	Exclude this path from the rules
One site on several domains	Only domains that point here get a certificate	Check all domains
Issuance limit	Let’s Encrypt limits frequent requests	Wait a day

If there is still no certificate after 24 hours with correct DNS, open a ticket and state the domain and time (Describing errors well).

Check the certificate

• In the browser: click the padlock, “Connection is secure”, show certificate. You will see the issuer, domain and expiry date.
• On the command line:

curl -vI https://meinprojekt.de 2>&1 | grep -E "subject|issuer|expire"

openssl s_client -connect meinprojekt.de:443 -servername meinprojekt.de </dev/null 2>/dev/null | openssl x509 -noout -dates -subject

Use your own certificate

Besides Let’s Encrypt, you can use a certificate you bought or had issued elsewhere. You need:

• the certificate (ending .crt or .pem),
• the private key (.key),
• if applicable, the intermediate certificates (“chain” or “CA bundle”).

In the web panel you upload the files under the website’s domain in the SSL area. Keep the private key safe and never share it. You have to renew your own certificate yourself before it expires; Let’s Encrypt renews itself.

Let's Encrypt is usually enough

For websites, shops and blogs, the free certificate is enough. A certificate of your own is mainly worth it if an authority, a customer or a payment service requires a specific one (for example with company validation).

After setup: switch everything to https

A certificate alone does not force https. Two steps are still missing:

1. Set up a redirect from http:// to https://; there is an example in .htaccess basics.
2. Remove mixed content: images, scripts and styles must no longer be loaded over http. See SSL and mixed content.

HSTS

HSTS is an instruction to the browser: “From now on, only open this domain over https.” Switch it on only once everything runs stably over https, because it is hard to undo.

Header always set Strict-Transport-Security "max-age=31536000"

Frequently asked questions

Does the certificate cost anything?

The automatic Let’s Encrypt certificate is included in every web hosting plan.

How long is it valid?

Let’s Encrypt certificates are valid for 90 days and are renewed automatically before they expire.

Are there certificates for game servers?

Game servers do not need a certificate for the game connection. For a web interface on a VPS, such as your own web server, you can set up Let’s Encrypt yourself.

Why does the browser show “Not secure” despite a certificate?

Usually because of mixed content. Check the page as described in SSL and mixed content.

Further reading

• Fix SSL and mixed content
• Connect a domain to your website
• Solving DNS problems
• Website security