How to Set Up Free SSL Certificates

Every NexzaHost plan includes unlimited free SSL certificates issued by Let's Encrypt through AutoSSL, covering your domain and all of its subdomains, renewed automatically. This guide covers the general case — for a WordPress site there are extra steps in the WordPress SSL guide once the certificate is installed.

Why this is not optional

Browsers label plain HTTP pages as "Not secure" in the address bar, which measurably costs conversions on checkout and contact forms. Google has treated HTTPS as a ranking signal since 2014, and several browser APIs — geolocation, service workers, the clipboard — simply refuse to run on an insecure origin. A certificate takes two minutes and there is no cost.

Step 1 — Make sure DNS points here first

AutoSSL proves you control the domain by requesting a file from it over HTTP. If the domain still resolves to a previous host, that check reaches the wrong server and issuance fails with a validation error. The error looks alarming but usually means "not yet" rather than "broken".

Confirm the domain resolves to your NexzaHost IP before going further. nslookup yourdomain.com from a terminal, or any online DNS checker, is enough.

Step 2 — Run AutoSSL

In cPanel, open Security > SSL/TLS Status. You will see every domain, subdomain and alias on the account with its current certificate state.

• Tick your domain, the www version, and any subdomains you actually use
• Click Run AutoSSL
• Wait — issuance normally completes in a minute or two

The status column turns green when the certificate is installed. Include www even if you do not link to it; visitors and old backlinks will use it, and a certificate that omits it produces a full-page browser warning for those people.

Step 3 — Force HTTPS for everyone

A certificate makes HTTPS *available*. It does not stop anyone loading the HTTP version. To redirect every visitor, add this at the very top of .htaccess in public_html:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The 301 matters. It tells search engines the HTTPS version is the permanent one, so ranking signals consolidate onto a single address instead of splitting across two versions of every page.

If your application writes its own absolute URLs — most CMS platforms do — update its configured site address to the https:// form as well, or it will keep emitting HTTP links inside otherwise-secure pages.

What AutoSSL covers

• Your main domain and `www` — always, once selected
• Subdomains such as blog. or shop. — each needs to exist in cPanel first
• Addon and parked domains on the same account
• Mail services — mail.yourdomain.com gets covered too, so IMAP and SMTP connections are encrypted

Wildcard certificates are not part of Let's Encrypt AutoSSL on shared plans. If you generate subdomains programmatically and cannot enumerate them, that is a reason to move to a VPS where you control the certificate tooling.

Renewal

Let's Encrypt certificates last 90 days and AutoSSL renews them well before expiry, so there is nothing to put in a calendar. Renewal only fails when the domain stops resolving to our server — for example if nameservers are changed and the old ones are left in place. If you receive an expiry warning, check DNS before anything else.

When issuance fails

• "DCV check failed" — the domain is not resolving to this server yet, or a .htaccess rule is blocking the /.well-known/ path the validation uses. Make sure no redirect rule catches it.
• Certificate issued but the padlock is missing — something on the page still loads over http://. The browser console names the exact file under "Mixed Content".
• A redirect loop after adding the rewrite rule — usually Cloudflare with SSL mode set to Flexible. Set it to Full (strict).
• `www` warns but the root does not — www was not selected when AutoSSL ran. Re-run it with the box ticked.

If a certificate will not issue after DNS has clearly propagated, message support with the domain name. We can read the AutoSSL log directly and usually see the cause immediately.