Adding or removing names from a multi-domain certificate Changing a multi-domain certificate requires a planned reissue and deployment. Adding a hostname to DNS or the hosting panel does not add it to an…

Checking which names a wildcard certificate protects A wildcard such as *.example.com covers a single leftmost label, such as shop.example.com. Check the actual certificate's subject alternative names…

Choosing an SSL certificate for the names your website uses A TLS certificate, often sold as an SSL certificate, helps browsers establish an encrypted connection to a named service. Choose it by the hostnames you…

Completing HTTP file-based certificate validation File-based certificate validation requires the issuer's challenge to be publicly available at the exact URL it specifies. Uploading a text file…

Completing a certificate authority's DNS validation request DNS certificate validation proves control by publishing the certificate authority's exact challenge. It is useful when the website is not live yet or…

Completing certificate domain validation by email Email domain validation works when an authorised person receives and approves the certificate authority's challenge for the exact pending order. Use an…

Creating a certificate signing request in Plesk For a certificate ordered outside an automated Plesk workflow, generate a CSR in the domain's certificate repository and retain its matching private…

Finding and correcting mixed content on an HTTPS website Mixed content occurs when an HTTPS page requests resources over insecure HTTP. Fix the resource references in the application so images, scripts,…

Fixing a certificate hostname mismatch A hostname mismatch means the certificate presented by the server does not cover the name the client requested. Find the requested name and the…

Fixing an incomplete certificate chain An incomplete certificate chain means a client cannot build the required trust path from the website certificate to a trusted root. A certificate can…

Installing an issued certificate through cPanel Install the issued certificate in the cPanel account serving the website, using its matching private key and the issuer's current intermediate chain.…

Installing and assigning an issued certificate in Plesk Use the supported Plesk upload path for your certificate files, then confirm that the website is serving the new certificate. Plesk Obsidian commonly…

Investigating a certificate warning in an email application A mail certificate warning concerns the server your application is connecting to. Compare that configured server name with the certificate it presents,…

Managing separate edge and origin certificates for a CDN Track edge and origin certificates separately when a CDN or security proxy handles HTTPS. The edge certificate serves visitors; the origin certificate…

Planning HSTS after every required hostname works with HTTPS Enable HSTS only after the required website names work reliably over HTTPS and certificate renewal is under control. HSTS tells supporting browsers to…

Redirecting HTTP to HTTPS safely with an Apache .htaccess rule Use an HTTPS redirect after the website has a valid certificate and works correctly over HTTPS. On an Apache-compatible hosting service, an .htaccess…

Renewing and replacing SSL certificates under current validity limits Renewal requires a valid certificate to be issued and installed before the current one expires. Paying an invoice alone does not prove that the…

Replacing a certificate when the private key is lost or exposed A certificate cannot be installed with an unrelated private key. If the matching key is genuinely unavailable, create a new key and request a…

Requesting certificate revocation after a key compromise Report a compromised certificate private key promptly and arrange revocation through the issuer or the authorised Nabtech certificate order. Revocation…

Understanding a certificate issuance failure caused by CAA A CAA failure can mean that your DNS policy does not authorise the requested certificate authority, or that the authority cannot reliably read the…