Activating and renewing an SSL certificate and troubleshooting issues

With an SSL certificate, your website is reachable via https, with a padlock in the address bar. At WebOké you get a free Let's Encrypt certificate that renews automatically. Below you can read how to turn it on, how subdomains work, and what to do if the certificate has expired or your site still shows 'not secure'.

New domains usually get a certificate automatically, within a few hours after the domain points to our server. No padlock? Then you can turn it on yourself in DirectAdmin.

How to turn on the certificate

1. Log in to DirectAdmin: in My WebOké, go to My Products and click DirectAdmin next to your hosting package.
2. Under Account Manager, click SSL Certificates. If you have multiple domains, select the domain at the top right.
3. On the Manage Certificates tab you can see whether there is already a certificate. Does it say the ACME system is disabled? Then go to the ACME Settings tab.
4. Turn on Enable ACME, leave the other settings as they are and click Save Changes at the bottom.
5. Go back to Manage Certificates and, under Automatic Certificate Issuance, click Request Now. Confirm the prompt.

The request runs in the background and usually takes a few minutes. After that, the certificate appears in the Certificate List. It covers your domain, www and also mail, ftp, pop and smtp, and DirectAdmin renews it automatically. If you don't click Request Now, DirectAdmin will do it by itself within 24 hours.

A certificate for a subdomain

A subdomain, such as shop.yourdomain.nl, automatically gets its own place in the certificate. You don't need to order anything separately.

• Create the subdomain in Subdomain Management and make sure it points to our server in the DNS.
• DirectAdmin requests the certificate during the next automatic run, within 24 hours. Don't want to wait? Then click Request Now in SSL Certificates.
• Do you see a certificate on the subdomain in the name of the server (such as linux2023.webawere.nl), or a message saying the name doesn't match? Then the subdomain doesn't have its own certificate yet. Check the DNS and request it again.
• A wildcard certificate (*.yourdomain.nl) is only possible if your domain's DNS is hosted at WebOké (ns1.webawere.nl and ns2.webawere.nl). If your DNS is hosted elsewhere, such as at Cloudflare, turn off the Prefer wildcard certificates switch in ACME Settings. You'll then get a certificate with the individual names, which works just as well.

You can read more about this in Certificate for www, subdomains and wildcard. If the subdomain itself isn't working yet, read Creating a subdomain, and what to do if it doesn't work.

Request not working?

Is there a list under Failed HTTP Checks? Then Let's Encrypt can't verify those names. Usually the domain doesn't point to our server (yet), for example because a migration is still in progress or the DNS is hosted elsewhere. After a DNS change, it can sometimes take a few hours before the certificate can be requested. With Domain Health you can quickly see whether your domain points to us.

Are only mail, ftp, pop or smtp in the list, and is your email hosted elsewhere? Then that's not a problem: your website will still get a certificate.

Certificate expired or not renewed?

DirectAdmin renews the certificate automatically, but for that Let's Encrypt has to be able to verify your domain again each time. If the certificate has expired, that check has failed. Go through these points:

1. Does your domain still point to us? Check the A record and also the AAAA record (IPv6). If either one points to a different server, the check fails. See Website or email not working after a migration or DNS change: check your domain.
2. Are you using the Cloudflare proxy? If the orange cloud is on, turn it off temporarily (grey cloud) until the certificate is in place.
3. Is there a CAA record in your DNS? Then letsencrypt.org must be included in it. Add it or remove the CAA record.
4. Is your website blocking the check? Let's Encrypt retrieves a file from the /.well-known/acme-challenge/ folder. A custom rule in .htaccess, a security plugin or a password-protected folder can block this. Remove such a rule temporarily or add an exception for .well-known.
5. Have you ever uploaded your own certificate? If it has expired or doesn't match the name, delete it in the Certificate List. DirectAdmin can then request a free certificate again.
6. Request the certificate again with Request Now, after you've fixed the cause.

You'll find all messages and solutions in one overview in Let's Encrypt not working: causes and solutions. If you see a message such as ERR_SSL or NET::ERR_CERT in the browser, read ERR_SSL and other certificate errors in the browser.

Certificate active, but still 'not secure'?

Is your certificate working, but the browser shows no padlock or the message 'not secure'? Then it's usually one of these causes:

• Mixed content: your page is still loading images, fonts or scripts via http://. Press F12 in your browser and open the Console tab. There you'll see Mixed Content messages with the address of each item that is still loading via http. Replace those addresses with https://.
• The name isn't in the certificate: for example, you're opening www, a domain pointer or a forwarded domain that doesn't have a certificate. Click the icon to the left of the address and check which name the certificate is for. Make sure that name points to us and request the certificate again.
• You're opening the site via http: redirect visitors to https automatically. Read Forcing visitors to https.

You can read how to fix mixed content in WordPress and other websites in No padlock or 'not secure': fixing mixed content.

Still stuck?

Ask the AI assistant in My WebOké to check your certificate, or create a ticket. Include your domain name and what you see under Failed HTTP Checks.

Detailed explanation with screenshots: Requesting a free Let's Encrypt certificate in the DirectAdmin manual.

Do you have a VPS? Then follow the free course VPS and Linux server management, lesson 7.3 https with Let's Encrypt.