How to Enable a Free SSL Certificate

Free SSL on ZevsHost

All plans include a free Let's Encrypt SSL certificate with auto-renewal every 90 days. Renewal happens automatically through the background AutoSSL job — there is no need to track the expiration date manually as long as the domain points to ZevsHost's servers.

Activation in cPanel

1. Log in to cPanel
2. Find Security → SSL/TLS
3. Click Manage SSL Sites
4. Select your domain and click Autofill by Domain
5. Click Install Certificate

If the domain was just added and DNS has not propagated yet, AutoSSL cannot pass domain validation (HTTP validation) and postpones issuing the certificate until the next check cycle — usually a few hours.

Force HTTPS

To redirect all visitors to HTTPS, add to .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Real SSL Errors and What They Mean

If the certificate does not match the domain, the browser shows:

NET::ERR_CERT_COMMON_NAME_INVALID
ERR_SSL_PROTOCOL_ERROR

The first error means the certificate was issued for a different name — for example, it only covers yourdomain.com while the site is opened as www.yourdomain.com. You need to reissue the certificate for both name variants through "Autofill by Domain", which adds www automatically. The second error happens when the browser tries to open an HTTPS connection on a port where no certificate is installed at all, or the server only serves plain HTTP. Another common message is the mixed content warning in the browser's developer console:

Mixed Content: The page at 'https://yourdomain.com/' was loaded over
HTTPS, but requested an insecure image 'http://yourdomain.com/logo.png'

It does not block the page entirely, but the browser marks the site as "not fully secure" and removes the green padlock. The cause is hardcoded http:// links to images, scripts, or stylesheets in the template code.

Let's Encrypt vs Paid SSL

The difference between DV, OV, and EV validation levels is covered in detail in the article on SSL certificate types.

Checking Certificate Expiration Manually

Although AutoSSL renews the certificate on its own, it helps to be able to check the expiration date directly instead of relying only on cPanel's emails — renewal notices sometimes land in the administrator's spam filter:

echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -dates

The command prints two lines: notBefore, the issue date, and notAfter, the expiration date. If less than a week remains before notAfter and AutoSSL has stayed silent, it is worth opening "SSL/TLS Status" in cPanel manually and running a check — sometimes the renewal cycle skips a domain because of a temporary DNS validation failure at check time.

When Free SSL Is Not Enough

• You need a certificate with organization validation (OV) or extended validation (EV) for financial or legal services
• You need a single wildcard certificate covering an unlimited number of subdomains — on shared hosting this requires separate DNS validation that is not always available through the cPanel interface
• The site sits behind an external CDN or proxy (such as Cloudflare) in a mode that requires a compatible origin certificate — a separate issuance logic applies there
• You need a certificate valid for 1–2 years with no auto-renewal — for example, for embedded devices that check the expiration date manually
• The site sits behind a reverse proxy or load balancer that terminates TLS on its own — in that case cPanel's AutoSSL never sees the domain and cannot pass validation

Verification

1. Open your site over HTTPS. A padlock should appear in the browser's address bar
2. Check the certificate chain with openssl s_client -connect yourdomain.com:443 -servername yourdomain.com
3. Make sure the HTTP version of the site redirects to HTTPS instead of serving content directly: curl -I http://yourdomain.com should return status code 301

If mixed content warnings remain after installing the certificate, finding and fixing those links is covered in the article on Mixed Content HTTPS. To harden protection once the redirect is verified, it is worth enabling HSTS — see the article on HSTS: forced HTTPS.

Frequently asked questions

Do I need to renew the free SSL certificate myself?

No, the Let's Encrypt certificate renews automatically through the background AutoSSL job as long as the domain points to the hosting provider's servers and DNS records stay unchanged. Tracking the expiration date by hand is not required, though checking it directly once in a while helps, since renewal notices can end up in the administrator's spam filter.

Why doesn't the certificate get issued right away for a newly added domain?

When a domain has just been connected and its DNS records have not propagated across the network yet, the automatic issuance service cannot pass domain ownership verification, so it postpones issuing the certificate until the next check cycle. That usually takes a few hours, after which the attempt repeats on its own, without any action from the site owner.

Does the free certificate still work if the site sits behind an external CDN or proxy?

Not always: that setup needs a compatible certificate on the origin server and relies on separate issuance logic rather than the usual activation through the control panel. When the site sits behind its own reverse proxy or load balancer that terminates the TLS connection itself, the automatic issuance service cannot see the domain and cannot verify ownership of it.

Why does the browser still warn about mixed content after the certificate is installed?

That warning has nothing to do with the certificate itself: it appears when the template code hardcodes insecure links to images, scripts, or stylesheets. The page still loads normally, but the browser removes the green padlock and marks the connection as not fully secure until every such link in the code gets switched to a secure one.