One Certificate For Every Subdomain You Have
A wildcard certificate covers the main site and everything under it, mail, shop, staging, the client portal and anything you add next year, without issuing a new one each time. It costs nothing, because the certificate authority that changed this gives them away, and we set it up on your server, your panel or behind Cloudflare.
Free certificates last ninety days rather than a year, which is fine when renewal runs by itself and a problem the morning it does not. Getting the automation right is the actual job here, and an expired certificate takes a site down as completely as a server that has stopped.
How The Wildcard Part Works
A normal certificate is issued for the exact names you list on it, so every new subdomain means going back for another one. A wildcard is issued for the star instead, meaning anything sitting directly under your domain is already covered on the day you create it.
Which sounds like a small convenience and turns into a large one the moment a site has more than a handful of things running under it.
One certificate, all of these
The one thing worth knowing is that a wildcard covers one level. Something at shop.yourdomain.com is included, and anything deeper like eu.shop.yourdomain.com needs its own entry, which we add if your setup uses them.
Why it cannot be validated the normal way
An ordinary certificate is proved by dropping a file on the website, which is why those install in seconds. A wildcard cannot work that way, because there is no single site to drop the file on. It has to be proved through a record in your DNS instead, and that changes the whole job.
Which means the renewal needs DNS access
Every ninety days a fresh record has to appear and then disappear again. Doing that by hand four times a year works until the once somebody forgets, so it gets connected to your DNS provider properly and left running on its own. This is where most people who try it themselves get stuck.
And why the provider matters
Cloudflare, Route 53, DigitalOcean and most of the well known ones handle this cleanly. A few registrars still have no usable way in, and where that is the case we move the DNS somewhere that does or use a small delegation trick, rather than leaving you with something that needs doing manually.
What Gets Done On The Server
Nine things, and the first two are the ones that decide whether you ever think about this again. The rest are the bits that turn a certificate into a site which actually loads properly for everybody visiting it.
Renewal connected to your DNS
An API token from whoever runs your DNS, scoped so it can only touch the records this needs and nothing else on the account. Then the record gets created and cleaned up automatically every time, which is the whole reason the ninety day cycle stops being your problem.
A renewal forced early to prove it
Waiting three months to find out whether the automation works is not testing it. We push a renewal through on the day, watch the record appear and disappear, and confirm the server picks up the new certificate without anyone restarting anything by hand.
Installed wherever it needs to live
Apache, Nginx, cPanel, Plesk, aaPanel, a container setup or a load balancer sitting in front of several machines. Where the certificate has to appear in more than one place, the copy step goes into the renewal rather than being something somebody remembers.
Everything sent to the secure version
Plain HTTP redirected across every subdomain and both the www and bare versions of each, in one hop rather than bouncing through two or three. Multiple redirects are slow, and search engines are not fond of them either.
Mixed content hunted down
A page loading one image or script over plain HTTP is enough to break the padlock on an otherwise perfect setup. Content gets scanned, the offending references fixed at the source, and any hardcoded links in the database updated rather than patched over.
Modern protocols, old ones off
Current versions of TLS enabled, outdated ones disabled, and the cipher list set to something that scores well without breaking older phones your customers might still be using. Checked against an external test before it is called finished.
Mail and panels covered too
The certificate goes onto the mail server, the webmail, the control panel and anything else answering on a name under your domain. These are the ones that get forgotten, and they are usually the first place somebody sees a warning.
An alert if it ever does go quiet
Monitoring on the expiry date, so if renewal fails for a reason nobody predicted, a change of DNS provider for instance, somebody hears about it with weeks left rather than on the morning the site stops loading.
Notes on how to change it later
Where the certificate lives, what the renewal runs, and how to add a domain or move it to a new server. Written so somebody who is not you can follow it, because the whole point is that this stops needing attention.
When a paid certificate is actually worth it
For almost every site, a free certificate is identical in the browser and there is nothing to gain by paying. The encryption is the same, the padlock is the same, and no visitor can tell them apart.
Two exceptions are real. Some payment processors and enterprise procurement checklists specifically require a certificate with a company name validated on it, which free ones do not carry, and some organisations want the warranty that comes attached for compliance reasons rather than technical ones. If either of those is your situation we will say so instead of selling you a free one and leaving you to discover it. Hardening the server underneath is a separate job and it is covered on the server security page.
Packages And What They Cost
Paid once for the setup, with nothing recurring afterwards, since the certificate itself is free and the renewal runs on your own server. Pick by how many domains and servers are involved.
Wildcard Setup
One domain and all its subdomains, on one server. Covers most sites, including anyone running a panel with a few subdomains under it.
- Wildcard certificate covering unlimited subdomains
- Renewal connected to your DNS provider
- A renewal forced early to prove it works
- Installed on Apache, Nginx, cPanel, Plesk or aaPanel
- HTTP redirected to HTTPS in one hop
- Modern TLS on, outdated protocols off
- Checked against an external test before handover
- Written notes on where everything lives
Site And Server
The certificate plus everything around it, so the site loads clean rather than showing a warning because of one old image path.
- Everything in Wildcard Setup
- Mixed content found and fixed at the source
- Hardcoded links updated in the database
- Mail server, webmail and control panel covered
- Certificate copied wherever else it is needed
- Expiry monitored with an alert weeks in advance
- Security headers set alongside it
- Retested after the fixes, not just before
Multiple Domains
Several domains, several servers, a load balancer in front, or a DNS provider with no usable way in that needs working around.
- Any number of domains and subdomains
- Certificates distributed across several machines
- Load balancers and reverse proxies handled
- Awkward DNS providers worked around or moved
- Container and orchestration setups
- Existing broken renewals diagnosed and repaired
- Documentation your own team can work from
Added To Any Package
- Each additional domain on the same server $10
- Each additional server the certificate goes on $25
- Moving DNS to a provider that supports this $20
- Fixing a renewal somebody else set up $50
- Full server hardening alongside it $150
The certificate costs nothing and there is no annual fee waiting for you. Anything you already pay for, hosting, the domain, a Cloudflare plan, stays billed to you directly by those providers and none of it runs through us.
Tell Us The Domain And Where It Is Hosted
The domain, whoever runs your DNS, and what the site sits on, a panel, a plain server or something behind Cloudflare. That is enough for a price and a timeline. Most of these are finished the same day the access arrives, and if your certificate has already expired, say so and it goes to the front of the queue.
Talk about your setup