Set up a free SSL certificate and HTTPS in DirectAdmin

Every web hosting plan at EliteStarHosting includes a free SSL certificate from Let's Encrypt. It makes your website load over https://, puts a padlock in the address bar and encrypts everything visitors fill in. Without HTTPS, browsers warn that your site is not secure.

Usually there is little for you to do. DirectAdmin requests a certificate by itself when you add a domain, and renews it automatically. You check that it worked and make sure everyone arrives over HTTPS.

Before you start: your domain must point to us

Let's Encrypt only issues a certificate once it can verify that your domain really points to your website. For that, your domain needs to use our nameservers:

ns1.elitestarhosting.com
ns2.elitestarhosting.com

• Ordered your domain together with your web hosting? Then the nameservers are already set.
• Registered your domain earlier? Change the nameservers yourself at the company that holds your domain. If it is with us, you do that in the client area.

A nameserver change can take a few hours, sometimes longer, before it is visible everywhere. After that, your domain and www point to your web hosting automatically, and your site runs through our HTTP filtering, which stops attacks before they reach your website.

Requesting a free Let's Encrypt certificate

1. Log in to the web panel. If you have more than one domain, select the right domain first.
2. Go to Account Manager > SSL/TLS Certificates.
3. Open the Manage certificates tab. If it says All DNS names have valid TLS certificates, your domain is already secured and you can skip steps 4 and 5.
4. Does it say ACME is disabled for this domain? Then open the ACME settings tab, turn on Enable ACME and click Save changes. Leave the other settings as they are.
5. Go back to Manage certificates. Automatic certificate provisioning shows which names will get a certificate. You can start the request there right away, or wait: DirectAdmin does it by itself within 24 hours.

The certificate covers your domain with and without www. With our nameservers, DirectAdmin usually requests a wildcard certificate (*.yourdomain.com), which also covers subdomains such as shop.yourdomain.com. A subdomain you add later gets a certificate automatically too.

Don't choose Create self-signed certificate: browsers don't trust such a certificate.

Automatic renewal

A Let's Encrypt certificate is only valid for a short time, 90 days by default. You don't have to renew it yourself. Every 24 hours DirectAdmin checks what needs to be requested or renewed, and it renews your certificate well before it expires. Provisioning history shows earlier requests.

Sending every visitor to HTTPS

By default, DirectAdmin does not redirect visitors from http:// to https://. Anyone who types http://yourdomain.com can end up on the unsecured version. This is how you send everyone to HTTPS:

1. Go to Account Manager > Domains and click your domain.
2. Turn on Force SSL with https redirect and save the change.
3. Open http://yourdomain.com in a private window. You now end up on https://yourdomain.com.

Only turn this on once your certificate is valid, or visitors will get a warning. Already have your own HTTPS redirect in your .htaccess? Then use only one of the two, or your site can end up in an endless redirect loop.

Troubleshooting

No certificate is issued

• Your domain doesn't point to us yet. Check the nameservers and wait until the change is visible everywhere. Then start the request again under Manage certificates.
• Check the log. Provisioning log shows what happened during the request and where it failed.
• DirectAdmin waits before trying again. After a failed request, DirectAdmin waits longer each time, up to a week. So start the request yourself once your DNS is right.
• The name is on the skip list. DirectAdmin skips the names on that list. You find it under ACME settings. Take your name off with Remove.
• You have a CAA record. If you created CAA records yourself, one of them must allow Let's Encrypt: 0 issue "letsencrypt.org". Otherwise Let's Encrypt refuses the certificate.
• You are trying too often. Let's Encrypt allows no more than five failed attempts per name per hour, so fix the cause first.

A certificate, but still a warning

• Just requested it? Wait a few minutes and reload the page in a private window.
• No padlock, or a padlock with a warning? Then your page still loads images, scripts or fonts over http://. This is called mixed content. Press F12 and look in the Console to see which files they are.

Mixed content in WordPress

Does your site run on WordPress? Let WordPress make the switch itself:

1. In WordPress, go to Tools > Site Health.
2. Open the notice Your website does not use HTTPS and click Update your site to use HTTPS.

WordPress then sets your WordPress Address and Site Address to https://. From then on, it replaces old http:// links to your own site in your posts, pages and widgets when it shows them. You have to change links to other sites that still start with http:// yourself.

Don't see the button? Check that your certificate is valid first. If WP_HOME or WP_SITEURL is set in your wp-config.php, change the addresses there.

Stuck? Open a ticket through support or ask your question on our Discord. Include your domain name and what Manage certificates shows, so we can help you faster.

Read also: Connect your domain to web hosting: nameservers and DNS and Install WordPress on your web hosting: step by step.