What is an SSL Certificate?

An SSL Certificate (or a TLS certificate) is a periodically regenerated digital certificate that supports your website's authenticity and enables encryption for greater security between your web server and the visitor's browser. SSL certification is important to:

• Prevent others from intercepting the information passing between the server and the browser.
• Help users distinguish between the real version of your website and any fake versions created by other people.
• Verify ownership of a website.

CloudCannon recommends an SSL Certificate for every website you edit on CloudCannon.

HTTP vs HTTPS#

HTTP, or the HyperText Transfer Protocol, is the primary method used by the internet to transfer information between a browser and a web server. The acronym HTTP appears at the beginning of a website's URL.

Websites with a valid SSL Certificate use HTTPS instead, where the "S" stands for Secure. You can tell from the address bar whether a website uses a secure protocol.

Most browsers warn visitors before they attempt to visit an insecure website (i.e., HTTP instead of HTTPS). Depending on your browser, this can take the form of a white warning page where the user must explicitly choose to continue to the insecure website.

Warnings about insecure websites can lead to a higher user bounce rate (where users immediately "bounce" off your website before seeing any of your content). This might be because users are security conscious or because they lose interest due to an inefficient experience.

You can avoid these issues by adding an SSL Certificate to your Site to enable HTTPS.

How do SSL Certificates work?#

SSL Certificates contain the following details about your Site:

• Domain name — The address used to access a website (e.g., cloudcannon.com).
• Certificate expiration date — The date a certificate expires. Auto-generated SSL Certificates on CloudCannon renew automatically before they expire.
• Public key — A string used to encrypt data, protecting communication channels from unauthorized access. Data can only be decrypted with the corresponding private key.
• Certificate chain — A sequence of certificates that links the SSL Certificate for your Site to a trusted certificate authority, providing legitimacy to your SSL Certificate.
• Private key — A string used to decrypt data. The private key comes with the certificate, but is not shared with the visitor's browser.

When a browser attempts to connect to your website, it uses a process called a TLS handshake. This process validates the identity of the web server, the domain of your website, and prevents unauthorized access to the data passing between the user and your website.

In simple terms, the TLS handshake includes the following steps:

1. The user's browser contacts the web server hosting your website, listing the TLS versions and encryption methods the browser supports.
2. The web server replies with the TLS version and encryption method to use, and its SSL Certificate.
3. The browser checks that the SSL Certificate covers the domain, hasn't expired, and has a certificate chain that leads to a certificate authority the browser already trusts.
4. The web server proves it holds the private key that matches the public key in the SSL Certificate, and the browser and the web server agree on a session key that only they know.
5. The browser and the web server use the session key to encrypt everything they send each other for the rest of the session.

This process only takes milliseconds to complete, so it does not affect the user's experience on your website.

Depending on your browser, a padlock icon appears near your URL once you add an SSL Certificate to your website. You can click on this icon to review the publicly available certificate information.

TLS version#

Each Custom Domain you host on CloudCannon has a minimum TLS version.

• Minimum TLS version — The minimum version of TLS that a visitor's internet browser must have to access your Site.

A higher TLS version is a stronger cryptographic standard, including fixes for known vulnerabilities in previous versions. On CloudCannon, the minimum TLS version you can use for your Site is 1.2, however 1.3 is available if you require it.

Raising the minimum TLS version improves security, but visitors using older internet browsers or devices that do not support that version can no longer reach your Site. TLS 1.2 is widely supported across current browsers, so raise the minimum to 1.3 only when you are confident your visitors' clients support it.

You set the minimum TLS version once for each Custom Domain, and CloudCannon shows which of its Subdomains meet it. You can also raise it for a single Subdomain. For more information, please read our documentation on increasing the minimum TLS version for your domains.

Which SSL Certificate is right for your domain?#

On CloudCannon, each Subdomain of a Custom Domain has its own certificate, which covers every Site on that Subdomain. A Subdomain can use an auto-generated SSL Certificate or a Custom SSL Certificate.

The domain's wildcard SSL Certificate covers subdomains you haven't set up yet (e.g., *.example.com), so visitors to those subdomains reach your Fallback Redirect over HTTPS. Every Base Domain (e.g., example.com) gets a wildcard SSL Certificate when you connect it, whatever its hosting.

Auto-generated SSL Certificates

CloudCannon provides a free auto-generated SSL Certificate by default for each Subdomain you host on CloudCannon, and renews it automatically.

An auto-generated SSL Certificate may be right for you if you want CloudCannon to manage your certificates for you.

If you use an auto-generated SSL Certificate with external DNS, you need to add new TXT records at each renewal of the wildcard SSL Certificate for your Base Domain, or add one CNAME record that lets Cloudflare renew it on its own. For more information, please read our documentation on renewing the wildcard SSL Certificate on external DNS.

For more information, please read our documentation on adding an auto-generated SSL Certificate.

SSL Certificates on external DNS

If your Custom Domain uses external DNS, how an address gets HTTPS depends on whether you have added it as a Subdomain on CloudCannon:

• Subdomains you have added — Each Subdomain, including each Redirect Subdomain, gets its own certificate. Once the Subdomain's DNS record points at CloudCannon, CloudCannon validates the certificate over HTTP, so you usually don't need to add TXT records. If a Subdomain does need one, its HTTPS section lists it.
• Subdomains you haven't added — Only the wildcard SSL Certificate for your Base Domain covers these subdomains. Visitors only reach them if you add a wildcard DNS record (e.g., *.example.com). The TXT records for the first wildcard SSL Certificate are optional, because your Base Domain and the Subdomains you have added have their own certificates. Once you have a wildcard SSL Certificate, it needs new TXT records at your DNS Provider each time it renews, unless you add the one CNAME record that lets Cloudflare renew it on its own. Until the wildcard SSL Certificate is active, visitors to these subdomains see a security warning.

If visitors use an address on your domain, such as www.example.com, add it as its own Subdomain rather than relying on the Fallback Redirect and the wildcard SSL Certificate. To send its visitors somewhere else, add it as a Redirect Subdomain. Redirect Subdomains do not count toward the number of Custom Domains in your Subscription Plan. When you add your Base Domain as a new Subdomain to serve a Site, CloudCannon adds www.example.com as a redirect to it for you, unless www.example.com already exists, and the reverse when you add www.example.com. For more information, please read our documentation on managing your Redirect Subdomains.

If you manage your DNS in your own Cloudflare account and set a record's proxy status to Proxied, set the Subdomain's hosting to Cloudflare Proxy. For more information, please read our documentation on configuring Cloudflare Proxy.

Custom SSL Certificates

You can purchase a Custom SSL Certificate from a trusted third-party service and add your certificate details to CloudCannon. Each certificate you upload is saved to your Organization. The SSL Certificates page under Org Settings shows when each certificate expires and which Subdomains use it.

CloudCannon can't renew a certificate you upload. CloudCannon emails everyone who can edit the settings of a Base Domain with a Subdomain that still uses the certificate 14 days and 3 days before it expires. When the certificate expires, CloudCannon switches each Subdomain still using it to a certificate CloudCannon issues and renews. For more information, please read our documentation on what happens when an uploaded certificate expires.

• Custom SSL Certificate — A certificate you have generated using a trusted third-party service (e.g., GoDaddy, Google, AWS, Cloudflare). Most web hosting services also provide the option to generate Custom SSL Certificates.

A Custom SSL Certificate may be right for you if:

• You already have an SSL Certificate purchased through a third-party provider.
• Your company's security policies require you to have an SSL Certificate from an internally approved authority.

For more information, please read our documentation on adding a Custom SSL Certificate.