HTTPS is not working

FiniteHost issues a free Let's Encrypt certificate for every website automatically. The server checks every 30 seconds whether your domain points at it, and requests the certificate as soon as it does. If HTTPS has not appeared, almost always the DNS records are not quite right yet. This guide walks through the checks in order.

Before you start#

• Open SSL / HTTPS in the panel. Each site shows HTTPS on, Waiting for DNS or After setup.
• Open Domains & DNS and keep the records for your site in view: an A record for the domain and a CNAME for www.
• Have access to the DNS settings at your registrar or DNS provider.

How the certificates work#

Both renew automatically. You never upload or buy a certificate.

Checklist#

1. Check the A record value. It must be exactly the IP shown under Domains & DNS, for example 108.181.215.252. Run nslookup acme.in 8.8.8.8 (Windows) or dig +short acme.in @8.8.8.8 (macOS, Linux); the answer must be that IP and nothing else. See Check your DNS.
2. Remove other A records for the same name. Registrars often add a "parking" A record. If two A records exist, visitors and Let's Encrypt land on the wrong server half the time.
3. Remove AAAA (IPv6) records for the domain, unless FiniteHost gave you one. Let's Encrypt prefers IPv6 when it exists, and an old AAAA record makes the check fail. Test with dig AAAA acme.in or nslookup -type=AAAA acme.in: it should return nothing.
4. Turn off any proxy in front of the domain. On Cloudflare, set the A and CNAME records to DNS only (grey cloud), not Proxied (orange cloud). A proxy hides your server's IP, so the check fails.
5. Check the www CNAME. www must be a CNAME to the CDN host shown in the panel (for example acme-in.b-cdn.net), not an A record and not a URL redirect.
6. Wait. DNS changes take from a few minutes up to an hour (sometimes longer if the old record had a long TTL). After the records are right, HTTPS for the domain normally follows within minutes.
7. Check the plan is active. Certificates are only requested while the plan is active or in its grace period. If it is suspended, renew it.

The site opens on HTTPS but shows a warning#

• "Your connection is not private" on www only: the CDN certificate for www is issued after the CNAME points to the CDN and is retried about once an hour. Wait an hour after fixing the CNAME.
• Certificate for a different name: the domain still points at your old host. Recheck the A record and clear your computer's DNS cache (see Check your DNS).
• Padlock with a warning, or "not fully secure": the page is HTTPS but loads images or scripts over http://. That is mixed content, below.

Fix mixed content in WordPress#

1. Go to Settings → General in WordPress admin.
2. Change both WordPress Address (URL) and Site Address (URL) to https://acme.in.
3. Save, then sign in again.
4. Update old links in posts. Old content may still hold http://acme.in/... image links. A search-and-replace plugin can change http://acme.in to https://acme.in across the database. Take a backup first (see Import and export databases).
5. Clear any caching plugin's cache, then reload the page with Ctrl+F5.

For other PHP sites, search your code and templates for http:// links to your own domain and make them https:// or relative (/images/logo.png).

Troubleshooting tips#

• Works on mobile data, not on office Wi-Fi: the office DNS still has the old answer cached. Wait for the TTL to pass.
• Browser says too many redirects: a plugin or .htaccess-style rule forces HTTPS while a proxy (such as Cloudflare Flexible SSL) sends plain HTTP. Turn the proxy off. Note that .htaccess files are not used on FiniteHost.
• Visiting http:// does not redirect to https://: the redirect is switched on automatically when the certificate is issued. If HTTPS works but HTTP does not redirect, the certificate is very new; reload in a minute.

What's next#

• Connect your domain
• Check your DNS
• HTTPS certificates explained