Free SSL certificate: how to get HTTPS and fix "Not secure" on your website (2026)

What SSL (TLS) actually does

SSL — properly called TLS today — encrypts the connection between a visitor's browser and your server. Without it, anything typed into your site (passwords, phone numbers, card details, contact-form messages) travels in readable form across Wi-Fi networks and internet providers. With it, the traffic is encrypted, and the certificate proves to the browser that it is really talking to your domain.

Since 2018 browsers mark every plain-http page as "Not secure", and many show a full-page warning before forms. Search engines prefer HTTPS pages, payment gateways require it, and modern browser features (location, camera, service workers, many login systems) only work on HTTPS. In 2026 there is no reason for any website to run without it.

Free vs paid SSL: is a free certificate good enough?

For almost every website, yes. A free Let's Encrypt certificate uses the same encryption strength as a paid certificate and shows the same padlock. The differences are about paperwork, not security:

• Free (domain validated): proves you control the domain. Valid 90 days, renewed automatically. Right for websites, shops, blogs and apps.
• Paid OV/EV (organisation validated): the certificate authority also checks your company's documents. Browsers no longer show the company name in the address bar, so visitors see no difference; some tenders, banks or enterprise contracts still ask for one.
• Paid certificates usually last a year and include a warranty — but you must remember to renew and reinstall them yourself.

How free SSL works on Cloud Ninza

Every domain and its www get a free Let's Encrypt certificate automatically. The platform first checks that the name really reaches your server, orders the certificate only for names that pass, and renews it from 30 days before expiry. Until the real certificate arrives, a temporary one keeps https from failing completely, which matters behind Cloudflare.

The Domains and SSL page shows which names are covered, which are waiting and why, and Let's Encrypt's own message if something failed. "Check and issue now" retries at once. Once a domain has its first real certificate, HTTPS-only is turned on so visitors are always redirected to the secure address.

Step by step: switch your site to HTTPS

Whatever hosting you use, the order matters. Do it in this sequence and you avoid most errors:

• Point the domain and www to the server, and delete leftover A and AAAA records — a certificate cannot be issued for a name that reaches another server.
• Issue the certificate for both the domain and www.
• Open https://yourdomain in a private window and check the padlock before forcing anything.
• Turn on the http → https redirect ("Always use HTTPS").
• Update the site's own address: in WordPress, Settings → General → both addresses to https://; in Laravel, Django, Next.js and other apps, the APP_URL / base URL setting.
• Fix mixed content (next section), then check your most important pages: home, product, checkout, contact.

Mixed content: the padlock is there but broken

Mixed content means the page itself loads over https, but some images, scripts, fonts or stylesheets are still requested over http. Browsers block insecure scripts outright (which can break menus, sliders and checkout) and show a warning instead of a clean padlock.

Find them with the browser's developer tools: open the Console and look for "Mixed Content" messages, which name each file. Fix them at the source — replace http:// with https:// in theme settings, page builder content and custom code. On WordPress, a search-and-replace of http://yourdomain to https://yourdomain across the database (WP-CLI's wp search-replace, run from the Terminal, with a backup first) fixes thousands of old links in one go. Links to other websites that do not support HTTPS should be replaced or removed.

"Too many redirects" after turning on HTTPS

A redirect loop happens when two layers disagree. The classic case is Cloudflare in "Flexible" mode: Cloudflare connects to your server over http, the server redirects to https, Cloudflare asks over http again, forever. Set Cloudflare's SSL/TLS mode to Full or Full (strict). Other causes are a redirect plugin and a server-level redirect fighting each other, or a WordPress address still set to http:// — keep one redirect, in one place.

Certificate errors and what they mean

Browser warnings name the problem; each has a standard fix:

• NET::ERR_CERT_DATE_INVALID — the certificate expired. Renewal failed, usually because the domain no longer reaches the server or an old AAAA record exists.
• NET::ERR_CERT_COMMON_NAME_INVALID — the certificate does not cover the name in the address bar, often www or a subdomain that was never added.
• Certificate issued by an unknown authority — a self-signed or temporary certificate is still in place; issue the real one.
• Cloudflare 526 — Cloudflare in Full (strict) mode cannot verify your server's certificate; issue a valid one on the server, then keep strict mode.

Subdomains, email and other names

A certificate covers only the names listed on it. If you add shop.yourdomain or app.yourdomain, it needs its own certificate (on Cloud Ninza, each site and alias is added automatically when it points to the server). Email has its own: mail and webmail names need certificates too, so phones and mail apps connect securely — Cloud Ninza issues those for mail domains on its servers as well.

Keeping HTTPS healthy

Free certificates are short-lived by design, which forces automation — the main thing to check is that renewal really happens. Keep DNS pointing at the server, avoid leaving stray records behind after moves, and glance at the certificate's expiry date now and then (click the padlock → certificate). When moving hosts, make sure the new server issues its certificate before or right after the DNS switch, so visitors never see a warning.

How to check any website's certificate in 30 seconds

Click the padlock (or the site-settings icon) in the address bar, then "Connection is secure" → "Certificate is valid". You will see who issued it, which names it covers and when it expires. For a deeper check, free online SSL test tools grade the whole setup — protocol versions, certificate chain, redirect from http — and point out anything weak. On a terminal, openssl s_client -connect yourdomain.in:443 -servername yourdomain.in shows the certificate the server really sends, which helps when a CDN sits in front.

It is worth a quick check after every hosting move, DNS change or new subdomain: those are the moments certificates get left behind. On Cloud Ninza, the Domains and SSL page lists every name on each project with its certificate state and expiry, so you can see at a glance that nothing is waiting.

Key takeaways

The short version, for anyone skimming:

• Every website needs HTTPS in 2026; plain http shows "Not secure" and breaks forms, payments and SEO.
• A free Let's Encrypt certificate gives the same encryption as a paid one and renews automatically.
• Order matters: point DNS, issue the certificate, check, then force HTTPS and update the site address.
• Mixed content and Cloudflare "Flexible" mode cause most problems after switching.
• On Cloud Ninza every domain, www and subdomain gets free SSL and renewal automatically.