English
Magyar
An SSL certificate (or, more precisely, a TLS certificate) enables your website to be accessed via an encrypted HTTPS connection. Without it, browsers display a ‘not secure’ warning, data entered into forms is transmitted unencrypted, and search engines also rank the page lower. Furthermore, the rules changed in 2026: the validity period of certificates has been shortened, so as well as installing them, it has become important to organise their renewal.
In this guide, we’ll walk you through which certificate to choose, how to install the free Let’s Encrypt certificate and a paid certificate on cPanel hosting and your own server, how to enable HTTPS redirection, how to fix common errors, and what the 200-day validity period means.
Which certificate should you choose?
| Type | What does this prove? | Who is it for? |
|---|---|---|
| Domain validated (DV) | To ensure you have full control over your domain | Most websites, blogs and online shops |
| Organisation-verified (OV) | As well as the domain, the company’s existence and details are also | Companies for which it is important that their company name appears on the certificate |
| Wildcard | All top-level subdomains of a domain (*.cegnev.hu) |
When there are many subdomains |
| Multi-domain (SAN) | Multiple domains on a single certificate | Multiple domains on a single server |
The strength of the encryption is the same for all of them: a free certificate encrypts data just as effectively as an expensive one. The difference lies in what the issuer verifies and what additional services (warranty, organisational details, support) are included.
Free Let’s Encrypt: DV certificate, with automatic issuance and renewal. Available on all aWh hosting plans, and sufficient for most websites.
Paid certificate: is worth it if you want your company’s details to be verified (OV), if you want a guarantee, if the certificate is not to be installed on a hosting service that supports automatic certificates (such as a mail server or load balancer), or if a partner or tender specifically requires a paid certificate. aWh’s SSL certificates are available from €8.98 per year (excluding VAT). A comparison of Let’s Encrypt and paid SSL certificates will help you make your choice.
The 200-day rule
According to the joint rules of browser manufacturers and certificate authorities (CA/Browser Forum), public TLS certificates may have a maximum:
| Publication date | Maximum validity |
|---|---|
| Before 15 March 2026 | 398 days |
| From 15 March 2026 | 200 days |
| From 15 March 2027 | 100 days |
| From 15 March 2029 | 47 days |
Let’s Encrypt certificates have always been valid for 90 days and are renewed automatically, so you don’t need to do anything about them. With paid certificates, however, this means in practice that during a one-year subscription, the certificate must be reissued and installed at least once. With aWh, the second certificate in the annual package is free of charge, but reissuance is not automatic: you must keep an eye on the expiry date and initiate the process via the portal. The article on the shortening of SSL certificate validity periods provides detailed information about this rule change.
Enabling a free Let’s Encrypt certificate
cPanel hosting (AutoSSL)
On aWh’s cPanel hosting plans, AutoSSL automatically issues and renews certificates for all domains and subdomains whose DNS records point to the hosting account.
- Check that the domain’s A record points to the hosting IP address.
- In cPanel, open the ‘SSL/TLS Certificates’ menu item, then the ‘Status’ tab.
- If there is no valid certificate associated with a domain, click the ‘Run AutoSSL’ button.
If the domain is still pointing to the previous provider (for example, whilst undergoing a migration to a new provider or after changing the name servers), the certificate cannot be issued until the DNS changes take effect. If AutoSSL fails to issue a certificate, the most common reasons are: the domain does not point to the hosting account, a CAA record is blocking the issuer, or an .htaccess rule is blocking the validation request. These AutoSSL errors are discussed in this article.
Web hosting
On aWh’s KeyHelp-based web hosting, you can enable the Let’s Encrypt certificate for each domain as follows:
- Log in to the control panel and select ‘Domains’ from the menu on the left.
- Click on the pencil icon next to the domain, then click on the ‘Security’ tab.
- In the SSL/TLS certificate section, select the Let’s Encrypt certificate option, and in the ‘Enforce secure connection’ section, tick the ‘Enabled’ option so that the server automatically redirects from
http://addresses to thehttps://version. - Once saved, if the domain is already pointing to the hosting account, the certificate will be generated within a few minutes, and the system will automatically renew it from then on.
The steps are illustrated with images in the article on enabling Let’s Encrypt on your web hosting account.
On your own server (VPS)
Certbot is the most widely used tool on Linux VPS. For example, with Nginx:
sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d cegnev.hu -d www.cegnev.hu
Certbot configures the certificate on the web server and automatically performs its renewal using a timer. Detailed steps are set out in the article on requesting a certificate with Certbot; a wildcard certificate requires DNS-based validation, which you can read about in the article on DNS validation for Let’s Encrypt wildcard certificates.
Installing a paid certificate
1. The CSR and the private key
To issue a certificate, a CSR (Certificate Signing Request) is required, which contains the domain name, company details (for OV certificates) and the public key. The private key is generated alongside the CSR; it remains on the server and must never be disclosed. The certificate only works in conjunction with this private key.
2. Configuration via the aWh client portal
You can set up a certificate purchased from aWh via the client portal by clicking the ‘Configure SSL’ button:
- Autoinstall (via cPanel): if the domain is hosted on your cPanel hosting account with us. The portal generates the private key and the CSR, carries out the authentication, and once issued, the certificate is automatically installed in cPanel. This is the simplest method.
- Manual Enrolment: if the certificate is to be moved to another server (your own VPS, another provider, or a mail server). You can paste in your own CSR, or the portal can generate one for you; once issued, you install the certificate yourself.
You can verify ownership of your domain via email, by uploading a file (HTTP or HTTPS) or by providing a DNS record; our knowledge base article explains the different methods of domain validation. The entire process, including reissuance, is described step by step in the article on setting up and reissuing paid SSL certificates.
3. Manual installation in cPanel
If you are installing the certificate manually on a cPanel hosting account:
- Open the SSL/TLS menu item in cPanel, then select ‘Manage SSL sites’.
- Choose your domain.
- Paste in the certificate (CRT), the private key (KEY) and the intermediate certificate (CA bundle). If the private key was generated in cPanel, the system will find it automatically.
- Click the ‘Install Certificate’ button.
4. On your own server
On Nginx, the certificate and the intermediate certificate must be concatenated into a single file (the domain certificate first, followed by the intermediate certificate), and specified using the ssl_certificate and ssl_certificate_key directives. On Apache, you need SSLCertificateFile, SSLCertificateKeyFile and, for older versions, SSLCertificateChainFile. There is also a step-by-step guide to setting up SSL on an Apache server. You can read about converting between certificate formats (PEM, PFX) in the article on converting certificate formats.
Omitting the intermediate certificate is the most common error: it may work in a browser, but on some mobile devices, older systems and API clients, it causes a ‘untrusted certificate’ error. Our knowledge base article discusses the intermediate certificate (CA bundle).
HTTPS redirection
Once the certificate has been installed, the website will be accessible via both HTTP and HTTPS. Configure the site so that all visitors are automatically redirected to the HTTPS version:
- In cPanel, under the ‘Domains’ menu, use the ‘Force HTTPS Redirect’ toggle next to the domain.
-
In the
.htaccessfile (Apache, LiteSpeed):RewriteEngine On RewriteCond %{HTTPS} off RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301] - In WordPress, on the Settings › General page, you must change both the WordPress and website addresses
https://; otherwise, a redirect loop or mixed content may occur.
If your site runs reliably over HTTPS, you can use the HSTS header to instruct browsers to always connect to the domain via HTTPS. Our article on enabling HSTS covers this topic. We also have a separate article on redirecting to HTTPS.
Checking and troubleshooting
Check: open the page in your browser and click on the icon next to the address bar: there you will see the issuer and the expiry date. For a detailed check, SSL Labs’ free test shows the chain, protocols and any errors.
Common errors:
- “The connection is not private” /
NET::ERR_CERT_COMMON_NAME_INVALID: the certificate is not issued for the name under which you opened the page (for example, only for the version withoutwww). This is discussed in the article on the “Your connection is not private” error. - Expired certificate: for paid certificates, initiate the reissuance process; for Let’s Encrypt, check why it hasn’t been renewed.
- Missing intermediate certificate: install the CA bundle as well.
- Mixed content: the page loads via HTTPS, but images, scripts or style sheets are loaded via HTTP, which is why a warning appears instead of the padlock. Our knowledge base article on the mixed content error and our blog post on fixing the mixed content error explain how to resolve this issue.
- Email client certificate error: in your email client, you must enter the name of the server for which the certificate is valid; you can read more about this in the article on certificate errors in email clients.
- Behind the scenes at Cloudflare: the SSL mode must be set to ‘Full (strict)’, otherwise a redirect loop or unencrypted section may occur; see the article on Cloudflare’s SSL modes for details.
Summary
For most websites, the free, automatically renewing Let’s Encrypt certificate is sufficient; on aWh’s hosting plans, this can be done with a single click. Choose a paid certificate if you also want your company details to be verified, or if you have specific requirements, and bear in mind that from 15 March 2026, you will need to have it reissued at least once during a one-year subscription. After installation, enable HTTPS redirection and check that there is no mixed content.
Check out the SSL certificates
Frequently Asked Questions
How long does it take to install an SSL certificate?
The free Let’s Encrypt certificate can be issued in a matter of minutes. The paid DV certificate can be issued within minutes following verification, whilst the OV certificate may take 1–3 working days due to the verification of company details.
Why does my browser say the connection isn’t secure, even though I’ve installed the certificate?
This is most commonly due to mixed content (images or scripts loaded via HTTP), or because the certificate is not issued for the domain name under which you accessed the site, or perhaps the intermediate certificate is missing.
How do I renew my paid certificate?
You can renew it via the client portal before it expires. With the annual package, the second certificate is free of charge due to the 200-day validity period, but you must initiate the renewal yourself; certificates installed in Autoinstall mode are then automatically added to the client portal.
Do you need a separate SSL certificate for each subdomain?
With Let’s Encrypt, each subdomain can be issued its own free certificate; AutoSSL handles this automatically. For paid certificates, a wildcard certificate is the most cost-effective option for multiple subdomains.
Does SSL slow down the website?
Not noticeably, no. Thanks to modern TLS 1.3 and HTTP/2, HTTPS pages are often faster than unencrypted ones.
How does Let’s Encrypt differ from a paid certificate?
The encryption is just as strong. Let’s Encrypt only verifies the domain, is valid for 90 days and performs automatic renewal; a paid certificate can also verify the company’s details (OV), comes with a guarantee and support, and can be installed on servers where there is no automatic renewal.
What is the 200-day rule?
Public SSL certificates have been valid for a maximum of 200 days since 15 March 2026; from 15 March 2027, they will be valid for 100 days, and from 15 March 2029, for 47 days. It is therefore becoming increasingly important to ensure automatic renewal of certificates.