SSL certificates make it possible for visitors to connect to your website over HTTPS, but enabling HTTPS is only the first step. This guide explains certificate types, custom-domain setup, renewal checks, and a practical way to diagnose browser warnings, mixed content, redirect loops, and failed renewals.
Overview
An SSL certificate authenticates a domain and helps encrypt data exchanged between a visitor’s browser and your server. When a certificate is correctly installed and the site is configured for HTTPS, browsers can display a secure connection and use https:// in the address.
People still commonly say “SSL,” although modern web connections generally use Transport Layer Security, or TLS. The practical setup is the same from a site owner’s perspective: obtain a certificate, validate domain control, install or activate the certificate, point the domain to the correct hosting service, and redirect HTTP traffic to HTTPS.
HTTPS does not replace strong passwords, software updates, backups, access controls, or secure application code. It protects the connection in transit and helps visitors verify that they are connecting to the intended domain. For a small business, creator site, landing page, or portfolio, certificate management should be treated as a recurring infrastructure task rather than a one-time checkbox.
The exact buttons differ between a managed cloud hosting platform, a website builder, and a self-managed server. The underlying checks are broadly the same.
What to track
Certificate coverage
First, record every hostname that should work over HTTPS. This may include the root domain, such as example.com, and a subdomain such as www.example.com. A certificate covering one hostname does not necessarily cover another. Confirm that the certificate’s names match the hostnames visitors actually use.
Also decide which hostname is canonical. For example, you might choose the non-www version as the primary address and redirect the www version to it, or make the opposite choice. The important point is consistency across DNS, the hosting dashboard, the website settings, canonical URLs, analytics configuration, and marketing links.
Certificate status and renewal
Track the certificate provider, covered domains, installation location, issuance date, expiration date, and renewal method. If renewal is automated, record which account or platform controls it. If renewal is manual, assign an owner and create reminders well before expiration.
Do not rely only on a calendar reminder. A renewal can fail because a DNS record changed, a domain no longer points to the expected host, an HTTP validation path is blocked, or an account credential has expired. The useful status is not merely “a certificate exists,” but “the live endpoint serves the expected certificate and the renewal process has been tested.”
HTTPS behavior
Check these URLs separately:
https://example.comhttps://www.example.comhttp://example.comhttp://www.example.com
Record whether each address loads the intended site, redirects to the preferred HTTPS hostname, or produces an error. A site can have a valid certificate while still sending visitors to the wrong hostname or leaving HTTP pages accessible without a redirect.
Mixed content and browser errors
Mixed content occurs when an HTTPS page requests a resource over HTTP. Images, stylesheets, scripts, fonts, video files, embedded forms, and third-party tools can all cause the problem. Track the affected page and the exact insecure URL rather than treating “mixed content” as a general site-wide issue.
For certificate errors, note the browser message, hostname, device or network, and time observed. Useful distinctions include an expired certificate, a hostname mismatch, an incomplete certificate chain, an untrusted issuer, or a certificate that has not yet become valid. These details narrow the investigation.
DNS and hosting dependencies
Keep a simple record of the DNS records related to the site. An unexpected A, AAAA, CNAME, or proxy configuration can send a hostname to a server that does not have the correct certificate. When changing hosts or completing a website migration to cloud hosting, include HTTPS verification in the migration checklist instead of waiting until after the DNS change.
For background on the records involved, see DNS Records Explained: A Practical Setup Guide for Websites and Email.
Cadence and checkpoints
A lightweight schedule prevents most certificate surprises:
- Monthly: Open the primary HTTPS URL and one alternate hostname. Confirm that the page loads without a certificate warning, the expected redirect occurs, and important forms or login flows still work.
- Quarterly: Review certificate coverage, expiration information, DNS records, hosting-domain settings, and renewal ownership. Check a representative set of pages for mixed content after major content or plugin changes.
- Before a domain or hosting change: Document the current DNS records, certificate method, canonical hostname, and redirect rules. Confirm how the destination platform will issue and install the replacement certificate.
- Before expiration: Verify that automated renewal is enabled and that domain validation can complete. For a manually managed certificate, schedule the replacement, installation, and post-change tests as separate tasks.
- After a deployment or DNS change: Test both the root and www hostnames, HTTP-to-HTTPS redirects, key pages, assets, forms, and any API or webhook endpoint that uses the domain.
Use this renewal calendar template:
- Domain and hostname:
- Certificate provider or hosting platform:
- Certificate coverage:
- Expiration date:
- Renewal method:
- Validation method and required DNS or HTTP record:
- Responsible owner:
- Next verification date:
- Result of the last live HTTPS test:
How to interpret changes
When HTTPS fails, start with the hostname and location of the failure. Use this decision tree:
- Does the browser report an expired or not-yet-valid certificate? Check the server’s certificate and system time. If the live certificate is old, investigate renewal and deployment logs.
- Does it report a hostname mismatch? Compare the address in the browser with the names covered by the certificate. Check whether the root and www hostnames terminate at different servers.
- Does the error appear only on one hostname? Review that hostname’s DNS record and hosting configuration. It may not be attached to the same site or certificate as the primary domain.
- Does the page load but show mixed content? Inspect browser developer tools for HTTP requests. Update hard-coded asset URLs, content settings, embedded resources, or third-party integrations to use HTTPS where supported.
- Does the site redirect repeatedly? Compare redirects at the DNS proxy, load balancer, hosting platform, application, and CMS layers. Remove conflicting HTTP-to-HTTPS or www-to-non-www rules so one layer owns each redirect.
- Did renewal fail? Confirm domain control, DNS propagation, validation records, account access, and the platform’s renewal logs. Then test the live certificate rather than assuming a successful order or request was deployed.
A redirect loop is usually a configuration conflict, not a certificate problem by itself. Mixed content is usually a page or asset reference problem, not proof that the certificate is invalid. Separating these symptoms helps avoid replacing a certificate when the real issue is DNS, application configuration, or an outdated URL.
After fixing an issue, test from a normal browser session and, when relevant, a second network. Clear assumptions about cached redirects, then verify the final URL, certificate hostname, page assets, forms, and key user journeys. Pair this check with a broader uptime and performance monitoring workflow.
When to revisit
Revisit this checklist monthly for a small but important site, and at least quarterly when the site has fewer changes or a managed platform handles renewal. Review it immediately after changing DNS, moving hosting, adding a subdomain, changing the canonical domain, installing a reverse proxy, redesigning the site, or adding third-party scripts and embeds.
Update the article or your internal runbook when the hosting platform changes its certificate workflow, the certificate provider changes validation requirements, browser behavior changes, or your organization changes who owns domain and hosting access. Keep the live test results and renewal owner current; these are more useful than a static setup screenshot.
For the next review, take ten minutes to open both HTTP and HTTPS versions of your main hostnames, confirm the redirect destination, inspect the certificate coverage, and check the renewal date. If anything changed, record the cause and the corrective action. That small habit keeps HTTPS reliable through renewals, redesigns, and hosting migrations.
