Official SSL/TLS Documentation & Server Tutorials

Complete Guide to Free SSL Certificates, ACME v2 & Server Installation

Learn how to generate, validate, and install free 90-day Let's Encrypt SSL certificates and Self-Signed Origin certificates across cPanel, Apache, Nginx, and Cloudflare.

Quick Navigation Index:

1. How to Install an SSL Certificate on cPanel 2. Configuring SSL/TLS on Nginx Web Server 3. Installing SSL Certificates on Apache HTTP Server 4. HTTP-01 File vs DNS-01 TXT Domain Validation Explained 5. Complete Guide to Wildcard SSL (*.domain) & SANs 6. Configuring Cloudflare Full (Strict) SSL Mode 7. Troubleshooting ACME v2 Validation & Rate Limit Errors 8. How HTTPS & TLS 1.3 Boost Google Search Rankings (SEO)

Tutorial #1 • Web Hosting & cPanel

1. How to Install Your Free SSL Certificate on cPanel (Step-by-Step)

cPanel is the world's most popular web hosting control panel. Once your certificate is issued on SSL Free Site and you download the ZIP bundle, follow these exact steps to enable HTTPS on your domain:

Step 1: Open SSL/TLS Manager in cPanel Log in to your cPanel dashboard, scroll down to the "Security" section, click on "SSL/TLS", and select "Manage SSL sites" under Install and Manage SSL for your site (HTTPS).

Step 2: Paste Certificate, Private Key, and CA Bundle Select your domain from the dropdown menu. Copy the contents of "certificate.crt" into the Certificate (CRT) box, "private.key" into the Private Key (KEY) box, and "ca_bundle.crt" into the Certificate Authority Bundle (CABUNDLE) box.

Step 3: Click Install Certificate & Enable Force HTTPS Click "Install Certificate". Once confirmed, navigate to "Domains" in cPanel and toggle on "Force HTTPS Redirect" so all visitors are automatically secured.

Tutorial #2 • Cloud VPS & Nginx

2. How to Configure SSL/TLS Certificates on Nginx (Ubuntu / Debian / CentOS)

Nginx requires your primary leaf certificate and intermediate CA bundle to be concatenated into a single file. SSL Free Site automatically generates this combined "fullchain.pem" file for you.

server {
    listen 443 ssl http2;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate     /etc/ssl/certs/fullchain.pem;
    ssl_certificate_key /etc/ssl/private/private.key;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;
}

3. Installing SSL Certificates on Apache2 HTTP Server

To enable HTTPS on Apache 2.4+, ensure mod_ssl is enabled, then update your VirtualHost configuration block on port 443 with the downloaded PEM files:

<VirtualHost *:443>
    ServerName yourdomain.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/certificate.crt
    SSLCertificateKeyFile   /etc/ssl/private/private.key
    SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt
</VirtualHost>

Tutorial #4 • ACME v2 Domain Validation

4. HTTP-01 File Upload vs. DNS-01 TXT Validation: Which Should You Choose?

Before a Certificate Authority like Let's Encrypt can sign an X.509 certificate for your domain, you must prove ownership via the RFC 8555 ACME v2 protocol:

HTTP-01 (File Upload)

Best for standard domains and subdomains hosted on cPanel or a web server. Instant verification with zero DNS propagation delay. Simply place the verification file inside /.well-known/acme-challenge/.

DNS-01 (TXT Record)

Required for Wildcard SSL certificates (*.yourdomain.com) and ideal when your web server is behind a firewall. Add a TXT record under _acme-challenge.yourdomain.com in Cloudflare or your DNS host.

Tutorial #5 • Wildcard SSL & Subdomains

5. Understanding Wildcard SSL Certificates (*.domain.com) & Root Domain Merging

When your web architecture spans multiple subdomains — such as api.example.com, app.example.com, mail.example.com, and staging.example.com — managing individual certificates quickly becomes complex. A Wildcard SSL certificate secures every single first-level subdomain under one unified key pair.

Why Merge Root Apex (domain.com) with Wildcard (*.domain.com)? Under RFC 5280 browser validation rules, "*.example.com" matches any single-level subdomain label but does not match the bare apex domain "example.com". SSL Free Site automatically merges both "example.com" and "*.example.com" into the certificate Subject Alternative Name (SAN) extension so visitors are protected whether they type the bare domain or any subdomain.

Tutorial #6 • Cloudflare CDN & Origin Security

6. How to Eliminate Cloudflare Error 525 & Enable Full (Strict) SSL Encryption

Using Cloudflare's "Flexible" SSL mode leaves traffic between Cloudflare edge servers and your origin hosting server unencrypted over port 80. To achieve true end-to-end encryption and prevent Error 525 (SSL Handshake Failed):

• For instant 1-Year Origin encryption: Generate a 365-Day Self-Signed Certificate on SSL Free Site, install it on your origin server, and set Cloudflare SSL/TLS mode to "Full".
• For maximum "Full (Strict)" security: Issue a Let's Encrypt ACME v2 certificate using DNS TXT validation (which works seamlessly even when Cloudflare Orange Cloud proxy is enabled) and install the fullchain bundle on your server.

Tutorial #7 • ACME v2 Troubleshooting

7. Troubleshooting Common Let's Encrypt ACME v2 Validation Errors

NXDOMAIN / DNS TXT Not Found Many DNS control panels automatically append your root domain name to the Host field. Always use our built-in Pre-Flight Validator button to confirm your TXT record resolves publicly before triggering ACME verification.

CAA Record Prevents Issuance If your domain zone defines Certification Authority Authorization (CAA) DNS records, ensure that "0 issue letsencrypt.org" (and "0 issuewild letsencrypt.org" for wildcards) is permitted.

Tutorial #8 • Technical SEO & Core Web Vitals

8. Why HTTPS, TLS 1.3 & HTTP/2 Are Essential for Google Search Rankings

Google officially incorporates HTTPS encryption as a positive search ranking signal. Beyond security and eliminating the "Not Secure" browser warning in Chrome, modern web performance protocols — including HTTP/2 multiplexing, HTTP/3 (QUIC), and Brotli compression — strictly require an active TLS certificate to function in modern browsers.