SSL certificates
How SSL works on OpenHost — automatic issuance, troubleshooting, and fixing mixed content warnings.
Every domain and subdomain on OpenHost gets a free SSL certificate, issued and renewed automatically. There is nothing to install, no CSR to generate, and nothing that expires on you.
How it works
- You add a domain to your site in the panel
- DNS resolves to OpenHost (either directly or via Cloudflare proxy)
- A certificate is issued within minutes via Let's Encrypt
- Renewal happens automatically 30 days before expiry
- HTTPS is enforced by default — HTTP requests redirect to HTTPS
Certificate coverage
| Scenario | Covered? |
|---|---|
Root domain (yourdomain.com) | Yes |
Subdomains (www, blog, shop, etc.) | Yes, each gets its own cert |
| Preview hostnames | Yes |
Wildcard (*.yourdomain.com) | Not by default — contact support |
| Multi-domain (SAN) | Each domain gets its own cert |
When SSL doesn't issue
Certificates require DNS to resolve to OpenHost. If yours is stuck:
Verify DNS
Run
dig +short yourdomain.com A— it should return your OpenHost server IP (shown in the panel).Check for conflicting records
Look for any
_acme-challengeTXT records left from a previous provider. Remove them.Wait for propagation
If you just changed DNS, allow up to an hour. Most certs issue within 5 minutes of DNS resolving.
Check Cloudflare settings
If using Cloudflare proxy (orange cloud): set SSL mode to Full (Strict) in Cloudflare dashboard → SSL/TLS. "Flexible" causes redirect loops.
Fixing mixed content warnings
After migrating a site to HTTPS, browsers may show a "Not secure" badge even though you have a valid certificate. This means mixed content — some resources (images, scripts, stylesheets) are still loaded over http://.
Find mixed content
- Open your site in Chrome
- Press F12 → Console tab
- Look for warnings like:
Mixed Content: The page was loaded over HTTPS, but requested an insecure resource - Note the URLs
Fix mixed content
| Source | Fix |
|---|---|
| WordPress post content | Install Better Search Replace → replace http://yourdomain.com with https://yourdomain.com |
| Theme hardcoded URLs | Edit theme files or use a child theme; replace http:// with https:// or // |
| External scripts/images | Update the embed code to use HTTPS, or re-host the asset |
| CDN URLs | Update CDN config to serve over HTTPS |
WordPress quick fix
# WP-CLI (if available via SSH/VPS)
wp search-replace 'http://yourdomain.com' 'https://yourdomain.com' --all-tablesOr in wp-admin: install Better Search Replace plugin, search http://yourdomain.com, replace with https://yourdomain.com, run on all tables.
HSTS (HTTP Strict Transport Security)
OpenHost enables HSTS headers by default. This tells browsers to always use HTTPS for your domain, even if a user types http://. Benefits:
- Prevents SSL-stripping attacks
- Eliminates the HTTP → HTTPS redirect latency on repeat visits
- Improves security posture for compliance
Cloudflare + OpenHost SSL
When using Cloudflare in front of OpenHost:
| Cloudflare SSL mode | What happens | Recommended? |
|---|---|---|
| Off | No encryption | No |
| Flexible | Encrypted visitor→Cloudflare, plain Cloudflare→origin | No (causes redirect loops) |
| Full | Encrypted both hops, accepts self-signed at origin | OK |
| Full (Strict) | Encrypted both hops, requires valid origin cert | Yes — use this |
OpenHost always has a valid origin certificate, so Full (Strict) is the correct setting.
Troubleshooting
| Issue | Fix |
|---|---|
| "Your connection is not private" | DNS not pointing to OpenHost yet; cert pending issuance |
| Redirect loop (ERR_TOO_MANY_REDIRECTS) | Cloudflare SSL set to "Flexible" — change to Full (Strict) |
| Mixed content warnings | Find and replace http:// URLs in content (see above) |
| Certificate expired | Should not happen (auto-renew). Check domain still resolves; contact support |
| Cert for wrong domain | Remove and re-add the domain in panel; verify DNS |