Choosing and installing an SSL certificate is easier when you separate certificate type, domain coverage, hosting configuration, and browser verification. This checklist explains the main SSL certificate types, shows how to install one through a hosting control panel or server, and gives you a practical workflow for resolving common HTTPS errors such as mixed content, redirect loops, certificate mismatches, and expiration warnings.
Overview
An SSL certificate enables encrypted communication between a visitor’s browser and your website. When the certificate is correctly installed and the site is configured to use it, visitors access the site with https:// and browsers can show a secure connection indicator.
SSL is commonly used as a general term, although modern certificate systems use TLS. In hosting dashboards, documentation, and support conversations, you will still usually see “SSL certificate.” The practical tasks remain the same: obtain a certificate for the correct hostname, install it on the server, configure HTTPS redirects carefully, and test every important URL.
SSL certificate types explained
| Type | Typical coverage or validation | When it may fit |
|---|---|---|
| DV | Domain validation confirms control of the domain. | Personal sites, blogs, applications, and many standard business websites. |
| OV | Domain validation plus additional organizational checks. | Organizations that want a certificate process involving verified business details. |
| Wildcard | Usually covers a domain and its eligible subdomains under the certificate’s scope. | Sites using several subdomains, such as www, app, or portal. |
| Free certificates | Often provide domain validation without a certificate purchase fee. | Most sites that need standard encrypted HTTPS and can support automated renewal. |
The right choice depends on hostname coverage, validation requirements, renewal support, and how your hosting environment is managed. A free SSL certificate can be appropriate for a production website, but it still needs correct installation and renewal. A paid certificate does not remove the need for secure server configuration, backups, updates, or application-level security.
Before making a choice, list every hostname that must work over HTTPS. Decide whether the site uses only the root domain, a www version, several subdomains, or separate domains. If you are still selecting a domain, review this domain registration checklist before configuring DNS and SSL.
Checklist by scenario
For a new website
- Confirm that the domain resolves to the intended hosting account or server.
- List the required hostnames, including the root domain,
www, and any subdomains. - Choose a certificate that covers those hostnames. Check whether your hosting plan includes free SSL or automated issuance.
- Install the certificate through the hosting control panel, or configure the certificate and private key on the web server.
- Test both HTTP and HTTPS versions before enabling a permanent redirect.
- Update the website’s configured base URL, canonical URLs, asset URLs, forms, and integrations where necessary.
- Enable an HTTP-to-HTTPS redirect only after HTTPS works correctly.
- Check key pages in a private browser window and review server or hosting-panel renewal information.
For a site using shared hosting or a control panel
Exact labels vary, but the workflow is usually similar. Open the security, SSL, or domain section of the control panel. Select the domain, request or upload a certificate, and allow the panel to complete domain validation. If the panel supports automatic SSL, confirm that the intended domain and aliases are included.
After installation, visit the site using https://. Test the root domain and the www version if both are configured. Then check whether the panel shows the certificate as active and records an upcoming renewal. For a cPanel-specific walkthrough, see How to Set Up SSL in cPanel.
For WordPress or another application
- Take a backup before changing the application URL or redirect behavior.
- Confirm that the hosting layer serves HTTPS successfully.
- Change the application’s site and home URLs to use
https://, using the application’s documented method. - Update hard-coded HTTP references in themes, templates, configuration files, databases, or deployment variables as appropriate.
- Clear application, plugin, server, and browser caches where applicable.
- Test login pages, forms, images, scripts, stylesheets, APIs, webhooks, and administrative tools.
Do not assume that changing the main site URL fixes every reference. A page can appear secure while a script, image, font, iframe, or API request still loads over HTTP.
For a VPS or developer-managed server
Confirm that DNS points to the correct server and that the web server is listening on the required ports. Install the certificate and private key using the server’s supported configuration, assign the certificate to the correct virtual host, and reload the service after validating the configuration. Check that the certificate chain is supplied when required by the server and that the private key has appropriately restricted permissions.
Test the exact hostname served by each virtual host. A certificate installed for one site does not automatically cover another site on the same VPS. If you are configuring a new server, the VPS hosting setup guide can be used alongside your server documentation.
What to double-check
Mixed content errors
A mixed content error occurs when an HTTPS page requests a resource over HTTP. Use the browser’s developer tools to identify the blocked or insecure URL. Correct the source where it is defined rather than relying only on a browser workaround. Check image URLs, scripts, stylesheets, fonts, embedded media, iframes, AJAX requests, and third-party services.
Also check CSS files for background images and JavaScript for API endpoints. If the resource belongs to a third party, confirm that its HTTPS version exists and update the integration. After making changes, clear relevant caches and test again.
Redirect loops
A redirect loop occurs when the browser is sent repeatedly between HTTP and HTTPS, or between different hostnames. Review redirect rules in the web server, hosting panel, content management system, reverse proxy, and content delivery layer. A common source of trouble is a proxy terminating HTTPS while the origin server incorrectly believes the request is HTTP.
Temporarily simplify the redirect chain and test one hostname at a time. Aim for one predictable destination, such as a single HTTPS version of the preferred domain.
Certificate mismatch or hostname errors
Check the hostname shown in the browser against the names covered by the certificate. Confirm that DNS points to the server presenting that certificate and that the server’s virtual-host configuration selects the right site. A mismatch can result from stale DNS, an incorrect certificate assignment, a missing www name, or a default certificate being returned by the server.
Expiration and renewal warnings
Record how renewal is handled. Automated renewal usually still depends on correct DNS, reachable validation paths, an active hosting account, and an installed renewal hook. Review the hosting dashboard or server logs before the certificate reaches its renewal window. If a certificate has already expired, install or renew it first, then retest redirects and application functionality.
For broader maintenance, use the website security and performance checklist to include certificates alongside backups, updates, monitoring, and access controls.
Common mistakes
- Installing a certificate for the wrong name: Confirm the root domain,
www, and subdomains before issuance. - Redirecting too early: Verify that HTTPS serves the complete site before forcing all HTTP traffic to HTTPS.
- Fixing only the homepage: Test login, checkout, forms, media, downloads, APIs, and administrative paths.
- Ignoring DNS: SSL cannot be reliably tested if the hostname resolves to an old server or the wrong hosting account. See the DNS records guide when checking A, CNAME, and related records.
- Forgetting renewal ownership: Document who receives certificate notifications and who can update DNS or the hosting configuration.
- Changing several layers at once: Record each change so you can identify whether the issue comes from DNS, the certificate, the web server, the application, or a proxy.
- Skipping a backup: Back up configuration and application data before URL migrations or broad search-and-replace operations.
When to revisit
Return to this checklist whenever you launch a website, add a subdomain, transfer a domain, migrate hosting, change DNS, replace a reverse proxy, or move between shared hosting and cloud infrastructure. A hosting migration checklist is useful when SSL changes are part of a larger move.
Review certificate coverage and renewal status during regular maintenance, before busy seasonal periods, and after changes to hosting or application deployment workflows. Revisit the process when your control panel, web server, certificate provider, or proxy configuration changes. Standards, browser behavior, and hosting tools can evolve, so confirm current instructions in the documentation for the platform you operate.
For the next HTTPS review, complete these actions: list the hostnames, confirm DNS, inspect certificate coverage, test HTTPS pages and assets, verify the redirect path, check renewal ownership, and record the result. Keeping that short record turns SSL troubleshooting from an emergency task into a repeatable website security routine.
