SSL certificates

Every site on Flashcloud gets HTTPS automatically. We auto-issue Let's Encrypt SSL certificates the moment you add a domain to your hosting, and we auto-renew them before expiry.

What we do automatically

When you add a domain or subdomain to your hosting:

• We issue an SSL certificate via Let's Encrypt within ~5 minutes of DNS pointing correctly.
• The certificate covers yourdomain.com and www.yourdomain.com — both work over HTTPS.
• We auto-renew the certificate every 60 days (Let's Encrypt certs are 90-day; renewing before expiry ensures continuous coverage).
• HTTPS is enforced — by default, plain HTTP requests redirect to HTTPS automatically.

You don't configure anything. The site loads on HTTPS, the green padlock appears in browsers, you're done.

Manual SSL management

For special cases — uploading a custom commercial certificate, configuring a non-Let's-Encrypt CA, or troubleshooting issuance — head into cPanel:

1. Open cPanel from your hosting service.
2. Find SSL/TLS Status (or SSL/TLS for the broader tool) under Security.
3. From there:
   • Run AutoSSL to manually trigger Let's Encrypt issuance.
   • Upload a custom certificate (.crt, .key, optional .cabundle).
   • Generate a CSR for purchasing a certificate from a commercial CA.
   • View certificate details — issuer, expiry, included domains.

For most users, the auto-issuance flow handles everything. SSL/TLS Status is the fallback for unusual setups.

Certificate types

Domain Validated (DV) — what we issue automatically

• Validates that you control the domain.
• Visible padlock in browsers, "Connection is secure" message.
• Free via Let's Encrypt.
• Issued in seconds, renewed automatically.

This is the right choice for almost every site.

Organization Validated (OV)

• Validates the organization behind the site (typically requires submitting business documents).
• Same padlock as DV in modern browsers — no visual difference.
• $50–200/year from commercial CAs.

Mostly historical at this point — modern browsers don't surface the OV vs DV distinction.

Extended Validation (EV)

• Validates the organization plus extended legal/financial vetting.
• Used to show the company name in the address bar (green bar).
• Modern browsers (since ~2019) no longer surface the green bar.
• $100–500/year from commercial CAs.

We don't recommend paying for EV anymore. The visual benefit is gone.

Wildcard SSL

• Covers *.yourdomain.com — every subdomain at once.
• Issued via Let's Encrypt's DNS-01 challenge if available, or commercial CA.
• Useful when you have many subdomains and don't want individual certs per subdomain.

For most sites, individual per-subdomain certs (auto-issued for each subdomain) are simpler. Wildcards make sense for SaaS apps with hundreds of customer subdomains.

To issue a wildcard via Let's Encrypt:

1. cPanel → SSL/TLS Status.
2. Click Run AutoSSL with the wildcard option enabled.
3. We'll add the required DNS TXT record automatically.

Custom certificates

If you've bought a certificate from a commercial CA (Sectigo, DigiCert, GoDaddy, etc.) and want to install it on your hosting:

1. cPanel → SSL/TLS → Manage SSL sites.
2. Pick the domain.
3. Paste:
   • Certificate (CRT) — the certificate body.
   • Private Key (KEY) — what you generated when you made the CSR.
   • Certificate Authority Bundle (CABUNDLE) — the chain certificate from the CA.
4. Install.

The custom certificate replaces the auto-issued Let's Encrypt one. Auto-renewal stops for that domain — you'll need to renew the commercial cert manually before it expires.

Why HTTPS matters

• Browsers warn visitors about non-HTTPS sites with "Not Secure" labels.
• Google ranks HTTPS sites higher in search.
• HTTP/2 and HTTP/3 require HTTPS (faster page loads).
• Modern web APIs (geolocation, service workers, secure cookies) require HTTPS.
• Privacy — without HTTPS, anyone on the network can see what visitors are doing on your site.

There's essentially no reason to run HTTP-only in 2026.

Common SSL issues

• "Not Secure" warning — certificate hasn't been issued yet (just added the domain — wait 5 minutes), or DNS isn't pointed correctly. See How long does DNS propagation take?.
• "Mixed content" warnings — HTTPS page loading some HTTP resources (images, scripts). Audit your content for http:// URLs and update to https://.
• "Certificate has expired" — auto-renewal failed. Check cPanel SSL/TLS Status; manually run AutoSSL. If it keeps failing, open a ticket.
• Custom certificate not installing — common cause is a mismatch between cert and key. Re-paste, ensure they're the matching pair.

Power-user note

For sites running behind Cloudflare proxy mode (orange cloud on), the SSL certificate visitors see is Cloudflare's, not ours. Ours is on the origin (your hosting), serving Cloudflare. This is "Full SSL" mode and is the right setup. "Flexible SSL" — HTTP between Cloudflare and origin — is unsafe and we don't recommend it.