Knowledge base
1000 FAQs, 500 tutorials and explanatory videos. Here, there are only solutions!
This guide explains the main differences between an EV and DV certificate.
SSL EV Certificates: for companies
The Sectigo SSL EV certificate can only be issued to companies registered in an official registry.
It provides the highest level of trust with your clients and offers unique advantages in addition to including the benefits of a DV certificate:
name of your company in thenavigation bar- lock in the navigation bar
- dynamic site seal
- domain name validation
- manual verification of your company's details and identity
- warranty up to $1,750,000 for end users
- 7/7 support
The activation of an EV SSL certificate may take up to 24 hours and will require action on your part.
SSL DV Certificates: for companies and individuals
The Sectigo DV certificate is available to individuals and companies. It does not include some of the advantages mentioned above, but it offers additional benefits compared to free Let's Encrypt SSL certificates:
- dynamic site seal
- domain name validation
- guarantee up to $10,000 for end users
- support 24/7
The activation of a DV SSL certificate is immediate.
And what about Let's Encrypt certificates?
A free Let's Encrypt certificate guarantees the same level of encryption as an EV or DV certificate. However, Let's Encrypt certificates do not offer the following benefits:
- manual validation of your company's credentials and authenticity (EV)
- warranty for end users in case of fraud (EV/DV)
- support in case of questions
In summary, Let's Encrypt certificates ensure the encryption of exchanges between your users and your site, but they do not guarantee to internet users that they are on a legitimate site whose identity has been authenticated by a certification authority.
This guide suggests solutions to resolve common issues and frequent errors that may occur when you try to display your website in https
after activating an SSL certificate.
The web browser automatically displays the http version of the site when you try to access it via https
It is recommended to perform the following actions:
- Clear the cache of your applications or your site.
- Check that the pages and scripts of the site do not contain redirects to the
http
version of the site. - Check that the site's
.htaccess
file does not contain redirects to the site'shttp
version. - Set the
https
address of the site as the default:
The website displays poorly (missing images, unsupported stylesheets, etc.) or displays a warning in the address bar
It is recommended to perform the following actions:
- Clear the cache of your applications or your site.
- Check that the pages and scripts do not point to external resources in
http
; the site whynopadlock.com can help you identify the unsecured elements of your site. - Also refer to this other guide on this topic.
"This web page has a redirect loop", "ERR_TOO_MANY_REDIRECTS"
If your web browser displays this error, it is recommended to perform the following actions:
- If the site runs on a web application like WordPress or Joomla, disable the extensions one by one to identify the problematic one.
- Check that the pages and scripts of the site do not contain redirects to the http version of the site.
- Try to disable HSTS.
- If **Prestashop** is used, you need to activate SSL **on all pages**:
- Add your SSL domain:
- Go to Preferences > SEO & URLs.
- In the "Shop URL" section, enter your site address in the "SSL Domain" field (without the
https://
, justwww.domain.xyz
).
- Activate SSL:
- Go to Preferences > General Settings.
- At the top of the page, click on "Click here to use the HTTPS protocol before activating SSL mode."
- A new page will open with your site in secure HTTPS version.
- Force SSL usage on the entire site:
- Go back to Preferences > General Settings.
- Set the "Enable SSL" option to YES.
- Also set "Force SSL usage for all pages" to YES.
- Add your SSL domain:
An old SSL certificate is displayed - clear the SSL cache
Web browsers cache SSL certificates to speed up navigation. Normally, this is not a problem. However, when you develop pages for your website or install a new certificate, the SSL state of the browser can hinder you. For example, you might not see the padlock icon in the browser's address bar after installing a new SSL certificate.
The first thing to do in this case is to make sure that the domain is correctly pointing to the server's IP address (A and AAAA records) and if it is still the wrong SSL certificate that is returned, clear the SSL cache:
- Chrome: go to Settings and click on Settings. Click on Show advanced settings. Under Network, click on Change proxy settings. The Internet Properties dialog box appears. Click on the Content tab. Click on Clear SSL state, then click OK. Find other tips in this other guide.
- Firefox: go to History. Click on Clear Recent History then select Active Logins and click on Clear Now.
Loss of CSS formatting
If the website displays without CSS styling, analyze the page loading with the browser's Console. There might be mixed content errors related to your .css
styles, which you will need to resolve to load them correctly again.
Cloudflare
If you use Cloudflare, refer to this other guide on the subject.
Thank you for choosing Infomaniak to secure your sites with an SSL certificate EV or DV from Sectigo.
An SSL certificate secures all exchanges between your server and your visitors, displays a padlock and adds the https to your site.
Which SSL certificate to choose?
- What are the requirements for an EV SSL certificate?
- What are the differences between an EV and DV certificate?
- Can I order an SSL certificate from Infomaniak if my site is hosted elsewhere?
- What does the warranty of a Sectigo SSL certificate exactly cover?
What would you like to do?
- Fix any potential errors after activating an SSL certificate
- Install a free Let's Encrypt SSL certificate on a site
- Install a wildcard certificate
- Uninstall a Let's Encrypt certificate
- Update a Let's Encrypt certificate (for example after adding/removing aliases)
- Familiarize yourself with all the FAQs about SSL
- Contact Infomaniak support
This guide helps you understand the error "Your Connection Is Not Private" when you try to access a website, whether you are the site owner or a simple visitor.
Understand the error
The error "Your Connection Is Not Private" sometimes appears in your browser when it has trouble establishing a secure connection with the site you are trying to visit. This usually happens when the website does not have a valid security certificate and does not use the SSL/TLS protocol to protect communication between the site and your web browser.
In fact, this is a security measure aimed at protecting your data. Websites with invalid SSL certificates may have security issues, making them less reliable. They can also expose your personal information to hackers if you enter sensitive data, such as your login credentials or payment information.
If you are a visitor
This may be due to configuration errors, such as an insecure Wi-Fi connection, incorrect date and time on your computer, or even an SSL/HTTPS analysis by your antivirus software.
If you own an Infomaniak website
Have you installed an SSL certificate?
Learn about the different certificates available on the Infomaniak site.
And if you already have an SSL certificate for your site, have you updated it to include any potential site aliases?
Check the SSL certificate expiration date
Certificates are renewed automatically. To check the expiration date:
- Click here to access the management of your product on the Infomaniak Manager (need help?).
- Check the column containing the expiration dates:
Check the installation
If you think you have activated SSL on your site, check a few points in this other guide.
This guide explains how to install a free SSL certificate from Let's Encrypt on a website hosted by Infomaniak.
Preamble
- Once the certificate is installed, your website will be accessible in
http
andhttps
… - If you want to include an alias domain recently added to your site that already had a certificate, you need to update it.
- For multiple subdomains, refer to this other guide.
- Let's Encrypt limits certificate installation to:
- 100 subdomains
- 20 certificates for 7 days per registered domain
- 5 failed requests per account per host name per hour
Install a free SSL certificate on a site
Prerequisites
- For the installation to be possible, the DNS of the domain name must be correctly configured to point to the site in question.
- If a change has recently been made at this level, some operations may not be functional immediately.
To access the websites to install an SSL certificate:
- Click here to access the management of your product on the Infomaniak Manager (need help?).
- Click directly on the name assigned to the product in question:
- Click on Configure under SSL Certificate:
- Click the Install certificate button:
- Choose the free certificate.
- Click on the Next button:
- Check or select the relevant domains.
- Click on the Install: button:
- Wait until the certificate is obtained on the site.
Refer to this guide if you encounter SSL errors and this other guide specifically if you use Cloudflare.
This guide explains how to renew a wildcard
certificate via DNS challenge using Certbot
.
Preamble
- Make sure to protect the configuration files and scripts containing sensitive information such as API tokens.
- Test the manual and automatic renewal process to ensure everything works correctly before the expiration date of the existing certificate.
Generate the wildcard certificate
Prerequisites
- Click here to access API management on the Manager Infomaniak (need help?).
- Create an Infomaniak API token with the scope "domain".
- Save this token for later use.
From a terminal application (command line interface, CLI) on your device, for example cmd on Windows or Terminal (installed by default on macOS), run the Certbot command with the following parameters:
certbot certonly --manual -d *.domain.tld --preferred-challenges dns-01 --server https://acme-v02.api.letsencrypt.org/directory
Create the TXT record
Create the TXT record for _acme_challengez.domain.tld
manually from the Infomaniak interface.
Set up automatic renewal
Create the renewal configuration file
Create or edit the file /etc/letsencrypt/renewal/domain.tld.conf
with the following information:
[...]
[renewalparams]
account = xxxxx
pref_challs = dns-01,
server = https://acme-v02.api.letsencrypt.org/directory
authenticator = manual
manual_auth_hook = /root/infomaniak-auth.sh
key_type = rsa
Create the script infomaniak-auth.sh
Create the file /root/infomaniak-auth.sh
with the following content:
#!/bin/bash
INFOMANIAK_API_TOKEN=XXXXXXX
certbot certonly \
--authenticator dns-infomaniak \
--server https://acme-v02.api.letsencrypt.org/directory \
--agree-tos \
--rsa-key-size 4096 \
-d $CERTBOT_DOMAINdsqqds
Replace XXXXXXX
with your Infomaniak API Token.
Automatic renewal
Schedule regular execution of certbot renew
via a cron job to account for the configuration file and automatically renew your certificate at regular intervals.
0 0 */x * * /usr/bin/certbot renew --quiet --config /etc/letsencrypt/renewal/domain.tld.conf
Replace /x
with the desired renewal frequency, for example every 30 days.
This guide explains how…
- … generate a
CSR
and private key to request a third-party certificate from a Certification Authority (CA
), - … import this certificate for your Infomaniak site, using the
CRT
obtained from theCA
.
Preamble
- Although Infomaniak offers all the SSL certificates you might need…
- free Let's Encrypt certs for personal sites (only possible with sites hosted at Infomaniak),
- DV certs from Sectigo for professional/private sites that are not registered in the trade register,
- EV certs from Sectigo for companies registered in the trade register,
- It is also possible to install an SSL certificate obtained elsewhere (intermediate certificate from a certification authority of your choice), custom or self-signed certificates.
1. Generate a CSR (Certificate Signing Request)
A CSR
(Certificate Signing Request
or Certificate Signing Request) is an encoded file containing the information necessary to request an SSL/TLS certificate.
It must be generated on your side to ensure that the private key remains under your control, using for example OpenSSL.
Adapt and run the following command from a terminal application (command line interface, CLI) on your device:
openssl req -utf8 -nodes -sha256 -newkey rsa:2048 -keyout domain.xyz.key -out domain.xyz.csr -addext "subjectAltName = DNS:domain.xyz, DNS:www.domain.xyz"
Explanations
newkey rsa:2048
: Generates a new 2048-bit RSA key.keyout domain.xyz.key
: Specifies the file where the private key will be saved.out domain.xyz.csr
: Specifies the file where the CSR will be saved.addext “subjectAltName = ...”
: Adds additional domains via theSAN (Subject Alternative Name)
extension, necessary to include all desired domains in the certificate (the main domain domain.xyz + any other associated domain or subdomain, such as www.domain.xyz).
After generation, you can check the contents of the CSR with the following command:
openssl req -in domain.xyz.csr -noout -text
This allows you to verify that all domains listed in subjectAltName
are correctly included.
Once the CSR is generated, you can send it to the certification authority (CA
) to obtain your SSL/TLS certificate.
2. Import the external certificate
Once validated, the CA
issues a certificate (domain.xyz.crt
) and sometimes an intermediate certificate (ca_bundle.crt
). To access SSL certificate management:
- Click here to access the management of your product on the Infomaniak Manager (need help?).
- Click directly on the name assigned to the relevant product.
- Click on SSL Certificates in the left sidebar.
- Click the blue Install a certificate button:
- Choose the custom certificate.
- Click on the Next button:
- Import your certificate and private key, either by importing the
.crt
and.key
files or by copy-pasting. - Click on Complete:
Alternative command to generate a self-signed certificate (optional)
If you want a local certificate for testing purposes only or without going through a CA
(not recommended for production), you can use this command:
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout domain.xyz.key -out domain.xyz.crt -addext “subjectAltName = DNS:domain.xyz, DNS:www.domain.xyz”
This generates both a self-signed certificate (domain.xyz.crt
) and a private key (domain.xyz.key
). However, self-signed certificates are not recognized as valid by public browsers or systems. They are only suitable for internal or development environments.
Import an intermediate certificate
When adding a custom SSL certificate, it is possible to import the intermediate certificate (by importing the .crt
file or pasting the data provided by the certification authority):
This guide details the conditions and procedure to obtain a EV SSL certificate from Sectigo with Infomaniak.
Preamble
- Extended Validation (EV) SSL certificates can only be issued to organizations, companies, and societies legally registered with a recognized government authority (such as a commercial register).
- The DV certificates from Sectigo and Let's Encrypt are not subject to this constraint.
- Compare the available SSL certificates
- In case of a DV or EV certificate validation issue, refer to this other guide.
EV Certificate Validation Procedure
Obtaining an EV SSL certificate can take up to 24 hours and requires valid information from the client.
This procedure is repeated every 12 months, regardless of the subscription duration chosen for the EV certificate.
1. Verification of the company's details
The data that will be added to the certificate must first be verified with an independent source:
- the legal or commercial name
- the legal form
- the address
- the postal code
- the region / the canton / the department
- the country / the country code
Attention:
- The company name must exactly match the one registered with the registry or the chamber of commerce; the order can only be processed if the given name is registered and correctly noted.
- Only the registered legal name or the brand name followed by the legal name in parentheses is allowed [example: Commercial Name (Legal Name)]; for entities without a legal name, all commercial names can be used.
- It is forbidden to use a postal address.
Given the above, a new request with correct data in the CSR is sometimes necessary, and Infomaniak may also need your approval to make changes to the information provided during the order.
2. Verification of data in the WHOIS directory
The WHOIS directory displays the information of the owner of a domain name. This data must match the information provided when ordering the EV SSL certificate.
To update the information for a domain in the WHOIS:
- If your domain is managed at Infomaniak, refer to this other guide.
- If your domain is not managed at Infomaniak, contact your host/registrar.
3. Contract & validation for the EV certificate
After ordering an EV certificate, the designated company contact person will receive an email from the certification authority Sectigo with the following documents:
- the certificate application form
- the certificate contract
These documents are pre-filled and the contact person must validate them online using an additional code. This will be provided by a Sectigo telephone robot (the call number will come from the Netherlands, +31 88 775 77 77 in principle) orally to your number registered with the registry or the chamber of commerce.
Each certificate request is validated by phone, including renewals and reissues of multi-domain certificates.
For any questions regarding validation, contact Sectigo directly.
4. Domain verification (for external sites only)
This step verifies that you have control over the domain (if it is external to Infomaniak) for which the certificate is requested. Domains of sites hosted at Infomaniak are automatically validated.
Each (sub-)domain must be approved individually via one of the methods described in this other guide.
This guide details the conditions and procedure for using a Sectigo Infomaniak certificate on a site hosted elsewhere, with a third-party host.
Preamble
- You have the possibility to benefit from the advantageous rates of Infomaniak for your SSL certificates while managing your sites with another host.
Install a Sectigo certificate
Due to the different service providers, the installation of your certificate will not be automatic:
1. Obtain the CSR
Export the CSR configuration file from your host and enter it when ordering your certificate at Infomaniak.
2. Confirm domain ownership
Validate the domains included in the certificate via one of the following methods:
- Enter a validation code received at one of the following email addresses (the complete email address must exist on the domain to be validated, for example “
domain.xyz
”):- admin@domain.xyz
- administrator@domain.xyz
- hostmaster@domain.xyz
- postmaster@domain.xyz
- webmaster@domain.xyz
- Creation of a unique CNAME record in the domain's DNS.
- Validation txt file to upload via FTP to your site.
This guide details the validity rules for SSL EV and DV certificates (effective as of September 1, 2020).
Validity period of SSL certificates
Following a meeting of the CA/B Forum, which brings together major web players (Safari, Google Chrome, Mozilla Firefox, etc. - learn more), it was decided to set the maximum validity period for SSL certificates to 397 days. This change aims, among other things, to limit the risk of certificate hacking and to increase the level of security of the certificates. It is not excluded that the maximum validity period of a certificate may be further shortened in the coming years. Some players like Apple, Google or even Sectigo are pushing in this direction.
The SSL certificates from Infomaniak Let's Encrypt are not affected by this change; Infomaniak takes care of everything! The EV and DV certificates from Sectigo issued before August 19, 2020 remain valid, regardless of their duration.
SSL DV Certificates from Sectigo
Sectigo SSL DV certificates with a duration of more than 1 year are automatically renewed by Infomaniak (certificate reissued during the month preceding its expiration date).
It is necessary to reinstall the certificate on your site if it is not managed by Infomaniak.
SSL EV Certificates from Sectigo
The SSL EV certificates from Sectigo will need to be validated each year, regardless of the chosen subscription duration.
It is necessary to reinstall the certificate on your site if it is not managed by Infomaniak.