Add SSL or HTTPS

All sites can have their own SSL certificate generated for them. The solution uses the Let's Encrypt project, which is an open-source Certificate Authority that offers free certificates. The solution does require that you have a domain successfully pointed at your site. See Go Live, Publish, and Set Up Your Domain for additional information.

• It is not possible to provide an SSL certificate for content that is hosted on a separate server.
• TLS 1.2 and later are supported.
• For the SSL certificate to be made, the domain can't be longer than 64 characters (including WWW).
• Adding AAAA and CAA records hinders the issuance of an SSL certificate. Please make sure that these records are not configured.

Do I need HTTPS?

Using a secure connection ensures that data is neither altered nor distorted during transport. Visitors can trust that a secure site displays the content you intended.

Furthermore, having a secure HTTPS connection is a tiny ranking signal that will help your site's overall SEO.

To set up SSL once your site has been published and configured with a custom domain:

1. Click Settings in the left panel, then the Site SSL tab.
2. To generate an SSL certificate, click Generate certificate. The entire procedure, from provisioning the request to Let's Encrypt and configuring the freshly produced SSL certificate, is automated and can take up to an hour. An "In progress" status indicates that the request is being addressed during the provisioning process. When the provisioning is finished, the provisioning status is updated to "Complete," and an approval email is sent to the account owner.
   
3. even though the SSL certificate has been accepted by the editor, it may not be displayed in the browser for up to 2 to 3 hours.
   
4. Click the Force visitors to use the secure connection (HTTPS) option to ensure that your site is always viewed over SSL. Once enabled, any visitor will be forwarded to the secure connection.
5. Publish your website again.

Unless you select Remove certificate, an SSL certificate is never destroyed.

Recreate SSL Certificates

If you previously configured your domain using a CNAME and 301 Redirect and have now altered your DNS settings to reflect a CNAME and two A Records, you will need to recreate your SSL Certificate.

To re-create the SSL certificate, follow these steps:

1. Click Settings in the left panel, then the Site SSL tab.
2. Click the Recreate Certificate button.
3. It will take some time for the certificate to be recreated.

Details About Secure Connections

• If you changed your DNS settings from the CNAME and 301 Redirect technique to the CNAME and two A Record approach, you will need to recreate your SSL certificate.
• Site certificates are good for three months. The site will renew the certificate two weeks before it expires to guarantee that the site stays safe and valid.
• Once your site has been configured with a certificate, you will notice a small lock icon on your Dashboard indicating that it is safe.
• HSTS Policy is used by Website Builder (HTTP Strict Transport Security). This feature aids in the prevention of protocol downgrade attacks and cookie hijacking.
• The DV (Domain Validated) certificate is used for the site's secure connection.
• Our SSL implementation on Windows XP is incompatible with any version of Internet Explorer (but will work on Chrome or Firefox).
• Android 2.3 and earlier are not compatible.
• We've added logic to the platform to prevent certain devices from being redirected to HTTPS. A security error/warning will occur if a user using an incompatible browser attempts to load the HTTPS version of the site. However, if the user visits the HTTP version of the site, the HTTPS version will simply not load.
• Our SSL solution currently does not support internationalized domain names (names with non-Latin letters, such as www.bücher.de).

Using Custom or Third Party Code in SSL Sites

HTTP or non-secured information cannot be shown in HTTPS or secure sites according to HTML requirements. This implies that any custom code that relies on an HTTP server to load content will not operate on an SSL Site. If you must employ code that ordinarily loads via an HTTP server, we propose the following:

• Requesting HTTPS-friendly code from your code provider.
• Disabling HTTPS for your Responsive Site

Because our editor appears by default over an HTTPS connection, seeing if code works in the editor is an excellent method to evaluate if it will function in the final site. If it does not, it is unlikely to operate on a live HTTPS site.