An SSL certificate helps your website establish encrypted HTTPS connections, but installing one is only the first step. This practical checklist explains how to choose a certificate, install it through common hosting workflows, confirm that HTTPS works correctly, configure renewal, and troubleshoot warnings after DNS changes, migrations, or configuration updates.
Overview
An SSL certificate, commonly associated with HTTPS, allows a browser to verify that it is connecting to the intended domain and helps protect data exchanged with the website. Certificate management usually involves four separate tasks: selecting the right certificate coverage, proving control of the domain, installing the certificate and private key on the web server, and maintaining renewal before the certificate expires.
Many web hosting plans include SSL certificate hosting through the control panel. Some providers offer automated issuance and renewal, while VPS hosting, cloud hosting, and developer hosting may require command-line configuration or deployment automation. The exact labels differ between platforms, so use this workflow as a framework and confirm the relevant steps in your hosting provider's documentation.
| Certificate setup | Suitable use | Key checks |
|---|---|---|
| Single-domain certificate | One domain or hostname | Confirm whether the certificate covers the exact hostname visitors use, such as the root domain or www. |
| Wildcard certificate | A domain and its direct subdomains | Check the wildcard scope. A wildcard for *.example.com does not automatically cover deeper levels such as app.eu.example.com. |
| Multi-domain certificate | Several specified domains or hostnames | Review every included name and keep the certificate's SAN entries current. |
| Automated certificate | Managed web hosting and repeatable deployments | Confirm that domain validation, renewal, and installation are all automated rather than only certificate issuance. |
Certificate type is only one part of the decision. Also check whether the certificate authority supports the validation method your DNS and hosting setup can complete, whether the hosting control panel can install it automatically, and whether all public hostnames are included. If you are connecting a domain to hosting, the DNS records must point to the system that is expected to answer the validation request. For background on that process, see this guide to connecting a domain to hosting.
Checklist by scenario
Installing SSL on shared or managed hosting
- Confirm the domain is added to the hosting account and that its DNS records point to the intended hosting service.
- Open the hosting control panel's security, SSL, or certificates area.
- Enable the provider's included or compatible certificate option for each required hostname.
- Complete domain validation if the panel requests it. DNS validation normally requires adding a specified record; another validation method may require a file or response to be available on the domain.
- Wait for installation to finish, then test both the root domain and any required
www, staging, or application subdomains. - Enable the panel's HTTPS redirect only after the HTTPS version loads correctly.
Managed WordPress hosting may provide an SSL toggle inside the WordPress hosting dashboard rather than the general control panel. Avoid installing a second certificate plugin or manually changing server settings until you know what the host already manages.
Installing SSL on a VPS, cloud server, or developer environment
- List every hostname that will serve traffic and decide whether one certificate or several certificates are easier to maintain.
- Verify that DNS points each hostname to the correct server or load balancer.
- Use a certificate issuance method supported by your server stack and certificate authority.
- Store the private key with restrictive permissions and keep it out of public repositories, build logs, and client-side bundles.
- Configure the web server or reverse proxy with the certificate chain and private key paths required by that software.
- Reload the service safely and test the configuration before making it the only production route.
- Record how renewal works. A scheduled renewal command is not enough unless the renewed certificate is also installed and the service is reloaded.
For Git-based deployments, treat certificate installation as part of the environment configuration rather than application code. Deployment instructions should identify where secrets are stored, how certificates are renewed, and how a failed renewal is reported. The Git hosting workflow guide provides related deployment planning guidance.
Renewing an existing certificate
Start by identifying the certificate's issuer, covered names, expiry date, validation method, and renewal owner. Automatic renewal is preferable when your hosting platform supports it, but verify that the complete process works. A useful test includes checking the renewal log or dashboard, confirming that the new certificate is installed, and verifying that the web server has loaded it.
For manual renewal, schedule a reminder well before expiry and repeat domain validation if required. Recheck DNS after domain registration changes, migration work, CDN changes, or a switch between shared hosting and VPS hosting. If a CAA record is present, it may restrict which certificate authorities can issue certificates for the domain. Make sure the permitted authority matches the service you are using before starting renewal.
Recovering from an expired or misconfigured certificate
- Confirm the warning is caused by the certificate rather than an incorrect system clock, DNS destination, or proxy configuration.
- Check the certificate's expiry date, issuer, subject names, and full chain.
- Verify that the certificate is installed on the server currently receiving HTTPS traffic.
- Renew or replace the certificate through the responsible hosting or server workflow.
- Reload the web server or proxy if the platform does not do so automatically.
- Test from an external connection and check all important hostnames, not just the homepage.
- Review monitoring and renewal logs so the cause is addressed rather than merely repaired.
What to double-check
HTTPS redirects and canonical URLs
After the certificate works, configure a redirect from HTTP to HTTPS if that matches your website's intended URL structure. Check that the redirect does not create a loop between your origin server and a CDN or reverse proxy. Your canonical tags, XML sitemap, internal links, and application settings should consistently use the preferred HTTPS URL.
Mixed-content errors
A page can have a valid certificate and still show browser warnings if it loads images, scripts, stylesheets, fonts, or API requests over HTTP. Inspect the browser developer tools for insecure requests, then update hard-coded URLs, CMS settings, theme files, database content, or third-party integrations. Do not solve mixed content by disabling browser security.
Hostname coverage
Test every hostname that users or systems access: the root domain, www, login pages, APIs, mail-related web interfaces, staging environments, and application subdomains where relevant. A certificate for example.com does not necessarily cover www.example.com, and a wildcard has defined limits.
Validation and DNS
Remove obsolete validation records only after confirming that no renewal process still depends on them. Check for conflicting CNAME, TXT, or CAA records, and remember that DNS changes may take time to appear across different resolvers. For a broader DNS reference, use this DNS records troubleshooting guide.
Private-key handling and backups
The private key must remain confidential. Limit file access, avoid emailing it unnecessarily, and never commit it to a public or shared code repository. Backups should protect configuration and recovery information, but they should use appropriate access controls. A backup is not a substitute for testing restoration or documenting who can renew and install the certificate.
Common mistakes
- Enabling redirects too early: Redirecting all traffic before HTTPS is functional can make diagnosis harder and may create an outage.
- Renewing the wrong certificate: A server may host several sites or certificates. Confirm the certificate actually presented for the affected hostname.
- Forgetting the chain: Installing only the leaf certificate can cause trust problems for some clients. Follow the hosting platform's required certificate-chain format.
- Ignoring proxies and CDNs: HTTPS may terminate at the proxy while the origin uses a separate connection. Document and secure both legs according to the architecture.
- Assuming automation is complete: Issuance, installation, service reload, and alerting are separate steps. Verify each one.
- Changing DNS without checking validation: A migration can interrupt renewal even when the website itself still appears online.
- Testing only in one browser: Check the certificate details, redirects, subdomains, and application requests from more than one network or testing environment when practical.
When to revisit
Use this checklist before a certificate's renewal window, before seasonal planning cycles, and whenever workflows or hosting tools change. Revisit it immediately after transferring a domain, changing nameservers, moving to new website hosting, adding a subdomain, introducing a CDN, changing a reverse proxy, or replacing a web server. It is also useful after a browser reports a certificate error, a monitoring system detects an unusual expiry date, or a deployment changes application URLs.
At least twice a year, review the certificate inventory and record the owner, covered hostnames, issuer, renewal method, validation method, expiry date, and recovery procedure. Remove certificates and DNS validation records that are no longer needed, confirm that alerts reach someone responsible, and test a renewal in a safe environment where your platform supports it. Keep the final runbook with your hosting and backup documentation; the hosting backup and recovery checklist can help place certificate recovery in a wider continuity plan.
Final action: Make a list of every public hostname, check the certificate currently served for each one, confirm the next renewal path, and document the exact person or system responsible. That short inventory turns SSL certificate maintenance from a last-minute warning into a repeatable part of website security and reliability.
