> ## Documentation Index
> Fetch the complete documentation index at: https://help.onetsolutions.net/llms.txt
> Use this file to discover all available pages before exploring further.

# SSL Certificates

> Secure your sites with HTTPS using the included SSL certificates

Every domain on your hosting gets a free SSL certificate, issued and renewed automatically. In most cases there is nothing to do — the certificate appears shortly after the domain starts pointing at the server.

<Info>
  **Prerequisites**

  * A Web Hosting service with OnetSolutions
  * A domain whose DNS points at your hosting
  * Access to your cPanel account
</Info>

## Checking Your Certificate

<Steps>
  <Step title="Log in to cPanel">
    Access your cPanel account through the OnetSolutions dashboard.
  </Step>

  <Step title="Open SSL/TLS Status">
    In the "Security" section, click "SSL/TLS Status".
  </Step>

  <Step title="Read the status">
    Each domain and subdomain is listed with its certificate state. A green entry is covered; anything else needs attention.
  </Step>
</Steps>

To check from outside cPanel, which is what your visitors actually experience:

```bash theme={null}
# Issuer and validity dates for a domain
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null \
  | openssl x509 -noout -issuer -dates
```

## Issuing or Renewing Manually

Certificates renew on their own well before expiry. If a domain is not covered — usually because it was added recently, or its DNS only just started resolving — you can trigger issuance:

<Steps>
  <Step title="Open SSL/TLS Status">
    In the "Security" section of cPanel.
  </Step>

  <Step title="Select the domains">
    Tick the domains and subdomains that are not covered.
  </Step>

  <Step title="Run AutoSSL">
    Click "Run AutoSSL". Issuance takes a few minutes.
  </Step>
</Steps>

<Note>
  A certificate can only be issued once the domain resolves to the server. If you have just changed nameservers or an A record, wait for that change to take effect before running AutoSSL — it validates by reaching the domain over the public internet.
</Note>

## Forcing HTTPS

A certificate makes HTTPS available; it does not make visitors use it. To send everyone to the secure version, see [HTTPS redirection](/web-hosting/https-redirection).

Until that redirect is in place, your site answers on both `http://` and `https://`, and search engines may index both.

## Mixed Content

The most common surprise after enabling HTTPS: the padlock does not appear, or appears with a warning, because the page loads some resources over plain HTTP.

Find the offenders in your page source:

```bash theme={null}
# Absolute http:// links in a WordPress theme
grep -rn "http://" wp-content/themes/your-theme/ | grep -v "http://www.w3.org"
```

For WordPress, the site and home URLs matter most:

```bash theme={null}
# Both should start with https://
wp option get siteurl
wp option get home
```

<Warning>
  Search-and-replace across a database to fix mixed content will corrupt serialised data if done with a plain SQL query. Use a tool that understands serialisation, such as `wp search-replace`, and export the database first.
</Warning>

## Troubleshooting

<AccordionGroup>
  <Accordion title="The browser reports the certificate does not match">
    The certificate covers a different name than the one visited — often `example.com` covered but `www.example.com` not, or the reverse. Run AutoSSL with both variants selected.
  </Accordion>

  <Accordion title="AutoSSL fails on one subdomain">
    The subdomain must resolve publicly. A subdomain that exists in cPanel but has no DNS record cannot be validated, and it is skipped.
  </Accordion>

  <Accordion title="The padlock shows a warning on a working certificate">
    Mixed content. The certificate is fine; the page is loading an image, script, or stylesheet over `http://`. Your browser's developer console lists each one.
  </Accordion>

  <Accordion title="The certificate expired">
    Automatic renewal happens ahead of expiry, so an expired certificate usually means validation has been failing for weeks — most often because the domain stopped resolving to this server. Confirm the DNS first, then run AutoSSL.
  </Accordion>
</AccordionGroup>

<Tip>
  After enabling HTTPS everywhere, set up the [HTTPS redirection](/web-hosting/https-redirection) so visitors and search engines converge on a single version of each URL.
</Tip>