Enabling SSL on Your Domain

SSL certificates are free on Traxio and normally issue automatically once your domain resolves to our servers. This article covers confirming that happened, issuing manually if it did not, and diagnosing the handful of things that block issuance.

Check whether you already have one

Open your site with https:// at the front. A padlock in the address bar means the certificate is working and there is nothing to do.

Issuing manually

1. Log in to DirectAdmin and open SSL Certificates.
2. Select Let's Encrypt as the certificate type — free, and renews automatically.
3. Tick the hostnames to include. Include both yourdomain.co.uk and www.yourdomain.co.uk; a certificate covering only one produces a browser warning on the other.
4. Save. Issuance usually completes within a minute.

When issuance fails

Let's Encrypt validates ownership by making an HTTP request to your domain. If it cannot reach your site, it cannot issue. The causes, in the order worth checking:

• DNS has not propagated. By far the most common. Your domain must actually resolve to Traxio first. Wait and retry.
• A CAA record is blocking it. If your domain has a CAA record naming a different certificate authority, Let's Encrypt is refused. Check for one in the DNS editor and either remove it or add letsencrypt.org.
• Cloudflare proxy interfering. If the orange cloud is on, validation requests may not reach your server. Temporarily set the record to DNS-only (grey cloud), issue the certificate, then re-enable the proxy.
• Rate limit hit. Let's Encrypt permits five failed attempts per hostname per hour. Repeatedly retrying makes this worse — wait an hour.
• An .htaccess rule blocking the validation path. A redirect catching everything can intercept /.well-known/acme-challenge/. Temporarily disable custom redirect rules and retry.

Renewal

Let's Encrypt certificates last 90 days and renew automatically about 30 days before expiry. You do not need to do anything — but if you later move your domain away and back, or change nameservers, check the padlock afterwards, since renewal can only succeed while the domain still resolves here.

After the certificate is working

Issuing the certificate does not stop people reaching the insecure version. Set up a redirect so every visitor lands on HTTPS — see Forcing an HTTPS Redirect.

If you run WordPress, also check Settings → General shows https:// in both URL fields, or you will get mixed-content warnings.

Curious what the certificate is actually doing? How SSL works explains the handshake and the padlock’s two promises.

What kind of certificate you get

The Let’s Encrypt certificates issued here are domain-validated (DV): they prove the site controls the domain, which is exactly what the padlock and the encryption require. There is no meaningful security difference between a free DV certificate and a paid one — the encryption is identical — and browsers display them the same way. Paid organisation-validated certificates still exist for institutions that want their legal identity embedded in the certificate details; a normal website needs none of that, and any host charging for “basic SSL” is charging for something the industry gives away.

The certificate covers the hostnames you ticked at issuance — typically the bare domain and www. If you later add a subdomain you want served over HTTPS, reissue with that name included; issuance is free and repeatable.

Checking the certificate yourself

Click the padlock in any browser and view the certificate details. Three things worth glancing at:

• Issued to — should list your domain (and www) among the names.
• Expiry — Let’s Encrypt certificates run 90 days and renew automatically around day 60, so a healthy certificate always shows between one and three months remaining.
• Issuer — Let’s Encrypt. If Cloudflare is proxying your site, visitors see a Cloudflare-issued certificate instead; that is normal, and your Traxio certificate still secures the Cloudflare-to-server leg.

For a deeper check, run your domain through SSL Labs’ free server test occasionally — an A grade means the whole configuration, not just the certificate, is right.

Fixing mixed content

A padlock with a warning triangle means the page is HTTPS but something on it — an image, stylesheet or script — still loads over plain HTTP. The browser console (F12 → Console) names each offending URL. The fixes, from most to least common:

• Hardcoded http:// URLs in content — old image links in posts and pages. On WordPress, a search-and-replace plugin swapping http://yourdomain for https://yourdomain clears these in one pass; take a backup first.
• WordPress site URL still set to http — Settings → General, both fields.
• A theme or plugin embedding an external HTTP resource — update it, or replace the resource with an HTTPS equivalent.

Frequently asked questions

Does SSL cost anything on Traxio?

No. Certificates are issued through Let’s Encrypt, are free, and renew automatically. This is true during the 30-day trial and after it.

Does HTTPS slow my site down?

Not measurably on modern servers — the handshake cost is tiny, and HTTPS unlocks HTTP/2, which typically makes pages faster by loading resources in parallel over one connection.

My certificate renewed but visitors still see a warning — why?

Usually a stale connection or cache on their side, or mixed content rather than the certificate itself. Check the padlock in a private window; if the certificate details show the new expiry date, the certificate is fine and the warning is one of the causes above.

Do I need a wildcard certificate?

Almost never on a small site. Naming the handful of subdomains you actually use at issuance covers the same ground without the extra validation requirements wildcards involve.