HTTPS & domains — Cheat Sheet

Every site here can be on HTTPS in about a minute, free, and a normal site's certificate renews itself. This page is the quick primer: the one setting, the DNS homework that makes it work, what the renewal email means, and the few per-site switches. Everything here links to the full story.

HTTPS in 30 seconds

1. One setting — the site's Edit tab → SSL Settings → Encryption: Required → Save. → Turn HTTPS on
2. One free certificate for every name — the queued Verify requests a Let's Encrypt certificate covering the main domain and every alias, including the automatic www companion. → Adding or changing aliases later
3. DNS comes first — every one of those names must point at this server; one missing name fails the whole certificate. → HTTPS for your sites
4. Renewal runs itself — nightly, well ahead of expiry, for every normal site; you only hear about it when DNS breaks. → Renewal happens by itself

Turn it on: one setting

Create the site first, then open its Edit tab and expand the collapsed SSL Settings fieldset. Set Encryption to Required (plain HTTP is redirected to HTTPS; Enabled serves both), leave Encryption key on Generate a new encryption key, and save. The Verify that saving queues requests the certificate; when it has finished, load the https:// address and look for the padlock.

→ Turn HTTPS on

DNS first: every name, www included

Let's Encrypt checks every name on the certificate — the main domain and every alias, the automatic www companion too — and if one of them doesn't point at this server, the whole request fails, and a site with no certificate yet is left on a self-signed placeholder that browsers warn about (with Required, every plain-HTTP visitor is sent to it). Point each name here with an A record (or a CNAME to the main domain), and delete any leftover AAAA record: the server answers on IPv4 only.

A new alias joins the certificate on the next Verify once its DNS resolves here. The alias boxes, the automatic companion and the canonical redirect live on the site's Edit form.

→ The DNS you have to set up · Sites & platforms cheat sheet

Renewal runs itself (and the one email it sends)

A nightly check renews every certificate well before it expires — nothing to remember, except for the two per-site switches below, whose certificates only a fresh Verify renews.

If a renewal fails, the account's email gets one notice, "Action needed: HTTPS certificate renewal failed for one or more of your sites", naming each site and why, at most about once a week per site. It almost always means DNS moved: point the name back here, or, if the site or alias is no longer used, set Encryption back to Disabled or remove the alias. Either stops the nightly attempts and the emails.

→ Renewal happens by itself

After a clone or a rename: off by design

A clone always starts with Encryption disabled, and a Migrate that changes the domain — www flips included — switches it off too: a certificate belongs to one exact set of names. Once the new name and its aliases resolve here, set Encryption back to Required on the site's Edit tab and save; the Verify issues a fresh certificate.

→ After a clone or a rename · Cloning & migrating

Dev-named sites get a placeholder

A site whose main domain has .dev., .devel., .test., .testing., .temp., .tmp. or .temporary. between dots gets a self-signed placeholder instead of a Let's Encrypt certificate: HTTPS works, browsers warn. stage and staging names are not excluded, and a .dev. alias on a normal site joins its real certificate. When a client needs to review a dev-named site without the warning, one empty file does it (the name needs real public DNS; if the site redirects to an alias, name the file after that alias):

touch ~/static/control/ssl-yes-dev-foo.dev.example.com.info   # then run Verify on the site

The nightly renewal skips dev-named sites, this one included, so run Verify on the site again before its certificate expires.

→ Development-named sites

One alias holding the rest up? Main name only

While an alias's DNS is still in someone else's hands, a per-site switch makes the certificate cover the main name only — an empty file named after the site's main domain (or after the alias it redirects to, if Redirect all domain aliases to points at one):

touch ~/static/control/ssl-no-san-example.com.info   # then run Verify on the site

Delete it and run Verify again once every alias resolves. When a multi-name order fails, the Verify task log names this exact file. The nightly renewal does not read it: while the file is in place it keeps asking for every name, so expect the renewal-failed email, and run Verify again before the certificate expires.

→ More per-site certificate switches

Your host's jobs

A wildcard certificate needs DNS API access your host sets up, so on hosted BOA it's a short support request. A certificate you bought (EV, commercial wildcard) is installed by your host too: send them the certificate, key and chain. And a certificate that won't issue although every name resolves here usually has a cause only your host can see, such as a Let's Encrypt rate limit — stop retrying and ask.

→ Using your own purchased certificate

The settings and files most people touch

One more per-site switch, for wildcards, needs your host's DNS wiring — see More per-site certificate switches.

If something's weird

• Required is saved, the Verify finished, but there's no padlock → one of the site's names — usually the www companion — doesn't point here yet, so the whole certificate was refused. Point every name here (and delete any stale AAAA), then run Verify. HTTPS for your sites.
• The site is fine, but one alias shows a security warning → that alias isn't on the certificate yet; it joins once its DNS resolves here. Fix its DNS, then run Verify. Aliases and redirects.
• "Not trusted" on a site named like foo.dev.example.com → by design: dev-named sites get a placeholder; the ssl-yes-dev- file above gives it a real certificate. Development-named sites.

Going deeper

• The whole topic, in depth: HTTPS for your sites — turning it on, DNS, aliases, renewal and the email, clones and renames, dev-named sites, the per-site switches.
• Aliases, the automatic www companion and the canonical redirect: Site aliases and redirects.
• Every control file in one table: Control-file reference.
• Renewal cadence and custom certificates (for operators): SSL operations.