Websites & Security

Installing your SSL certificate

Help centre Websites & Security

Last updated:

Every hosting plan with us already includes a free SSL certificate (see SSL/TLS certificates). This article is for the paid certificates you can buy from us, such as a business-validated or wildcard certificate. How much you need to do depends on how you bought it.

Bought with a hosting plan: nothing to do

If you bought the certificate with a hosting plan, or added it to your plan from your client area, we do everything for you: the certificate is requested, the domain is checked, and it's installed on your website. When it's renewed or reissued, the new one is installed automatically too.

To check it's working, open your website and click the padlock (or the settings icon) next to the address. It should say the connection is secure, and the certificate details should show the type you bought. For a business-validated (OV or EV) certificate, the details also show your organisation's name.

A domain-validated certificate is normally issued within minutes. Business-validated certificates take longer, because your organisation is checked (see below).

Bought on its own: setting it up

If you bought the certificate on its own, for example for a website hosted somewhere else, you set it up in three steps.

1. Create a CSR on the server that hosts your website

A CSR (certificate signing request) is a block of text, starting -----BEGIN CERTIFICATE REQUEST-----, that your web server creates. Create it in the control panel of the server where the website is hosted (most panels have an SSL or "Generate CSR" section), or ask whoever hosts your website. Keep the private key it creates: you'll need it to install the certificate.

The domain in the CSR must be the one you bought the certificate for. For a wildcard certificate, use *.example.co.uk.

2. Configure the certificate

After you pay, we email you a link to configure your certificate. You can also open it from the client area: My Services, then your SSL certificate. On the configuration page:

  1. Choose your web server type and paste in your CSR.
  2. Check the contact details.
  3. Choose how you'll prove you control the domain (see step 3).

3. Prove you control the domain

Before a certificate can be issued, the domain has to be checked. You choose one of these methods:

  • Approver email: an email is sent to an address at your domain, and you click the link in it. Only certain addresses can be used: admin@, administrator@, hostmaster@, postmaster@ or webmaster@ your domain. The address must be a real mailbox or alias that you can read; if it doesn't exist, create it first (see Creating mailboxes and email aliases).
  • File: you upload a small file to a folder named .well-known on your website. The configuration page shows the exact file name, contents and address. The file must open in a normal web browser, with no password. Not available for wildcard certificates.
  • DNS record: you add a TXT record to your domain's DNS. The configuration page shows the record to add. If your domain uses our nameservers, see Managing your DNS records.

The file and DNS methods are checked automatically every so often, so once they're in place the certificate follows without you doing anything else. If the method you chose isn't working, you can change to approver email with Change Approver Email on the certificate's page.

Installing it

Once it's issued, we email you the certificate, and you can view it any time with Retrieve Certificate on the certificate's page in the client area. Install it, together with the private key from your CSR, in the control panel of the server that hosts your website, or send it to whoever looks after that server.

Renewals and reissues

Browsers now only trust certificates for a limited time (currently about six months, and shorter from 2027), so a certificate bought for a year or more is reissued automatically several times during your subscription. You don't pay again for these.

  • Added to a hosting plan with us: each new certificate is installed automatically. Nothing to do.
  • Bought on its own: we email you when the new certificate is ready, and you need to install it on your server each time, the same way as the first one. If you forget, your website shows a security warning when the old one expires.

That's the main reason to add a certificate to your hosting plan if your website is hosted with us.

Reissuing it yourself

If you move server or lose the private key, you can reissue the certificate:

  1. In the client area, open My Services and your certificate. (If it was added to a hosting plan, open the hosting plan and find the certificate under Addons.)
  2. Click Reissue Certificate and paste in a new CSR.
  3. Approve the email sent to your approver address. A reissue can only be approved by email.
  4. Click Retrieve Certificate to get the new certificate, then install it.

A certificate can't be reissued for a different domain. For another domain, you need another certificate.

Business-validated (OV and EV) certificates

OV and EV certificates show your organisation's name in the certificate details, so the issuer checks your organisation is real before issuing one:

  • OV usually takes about a day. Expect a check of your company details against a public record, and a phone call to your organisation's listed number.
  • EV is the most thorough and usually takes one to three days. You may be asked for more documents.

Make sure the organisation details you give match your company's official records exactly. Most delays come from a mismatch, such as a trading name instead of the registered name.

Wildcard certificates

A wildcard certificate for *.example.co.uk covers every subdomain one level down, such as www.example.co.uk, shop.example.co.uk and mail.example.co.uk, as well as example.co.uk itself. It doesn't cover deeper levels, such as test.shop.example.co.uk.

Need a hand?

If a certificate is stuck waiting for validation, or you're not sure how to install it, contact our support team.