Every Fast Hive hosting plan includes a free SSL certificate that is issued and renewed automatically. Most customers never need to do anything at all. This guide covers what happens automatically, how to confirm it worked, and how to install a paid or third-party certificate when you need extended validation, a wildcard, or a warranty.
Part 1 - The free automatic certificate
What has to be true for it to issue
- The domain resolves to your Fast Hive server. Certificate authorities verify control by reaching the domain, so DNS must be correct first.
- The domain is added to the hosting account in cPanel.
- There is no CAA record blocking issuance.
- No redirect is intercepting the validation request at
/.well-known/acme-challenge/.
Checking the status
- Log in to cPanel from My Products & Services.
- Under Security, open SSL/TLS Certificates, then SSL/TLS Status.
- Every domain and subdomain on the account is listed with its certificate state.
- If something shows as unsecured, tick it and click Run AutoSSL. The result, including any failure reason, appears on the same page.
Part 2 - Installing a purchased certificate
Choose a paid certificate when you need organisation or extended validation, a wildcard covering every subdomain, a multi-domain certificate, or a warranty. You can order one from the Fast Hive SSL store.
Step 1 - Generate a CSR
- In cPanel, open Security → SSL/TLS Certificates.
- Click Generate, view, or delete SSL certificate signing requests.
- Fill in the form:
- Domains - the exact hostname the certificate must cover. For a wildcard, enter
*.yourdomain.com. - City, State, Country - spell them out; do not abbreviate the city or state.
- Company - your registered legal name for OV and EV certificates. It is verified.
- Email - a working address.
- Leave the passphrase blank.
- Domains - the exact hostname the certificate must cover. For a wildcard, enter
- Click Generate. Copy the entire CSR block, including the
-----BEGIN CERTIFICATE REQUEST-----and-----END CERTIFICATE REQUEST-----lines.
Step 2 - Submit the CSR and validate
- Place the order and paste the CSR when asked.
- Choose a validation method:
- Email - a link is sent to an approver address on the domain such as
admin@yourdomain.com. Make sure that mailbox exists first. - DNS - add a supplied CNAME or TXT record in cPanel's Zone Editor.
- File - upload a supplied file to
public_html/.well-known/pki-validation/.
- Email - a link is sent to an approver address on the domain such as
- Complete validation. Domain-validated certificates issue in minutes; organisation and extended validation take days, because a human checks your company records.
Step 3 - Install it
- The authority emails you a certificate (
.crt) and a CA bundle of intermediate certificates. - In cPanel, open Security → SSL/TLS Certificates → Manage SSL sites.
- Select the domain from the dropdown.
- Paste the certificate into Certificate (CRT). cPanel fills in the private key automatically.
- Paste the intermediates into Certificate Authority Bundle (CABUNDLE). Do not skip this - a missing bundle works in desktop browsers but fails on mobile devices and in API clients, which is a genuinely confusing bug to chase.
- Click Install Certificate.
Part 3 - Verify the installation
- Load
https://yourdomain.comand check the padlock appears. - Click the padlock and confirm the issuer, the covered names and the expiry date.
- Test both
yourdomain.comandwww.yourdomain.com- both must be covered. - Check from a phone as well, which will reveal a missing CA bundle.
- Run an online SSL checker for a full chain and configuration report.
From a terminal:
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -datesTroubleshooting
| Symptom | Cause and fix |
|---|---|
| Free certificate never issues | Nearly always DNS: the domain does not yet resolve to your Fast Hive server. Confirm with nslookup yourdomain.com 8.8.8.8, then re-run AutoSSL. |
| AutoSSL fails on one subdomain only | That subdomain does not resolve, or it is behind a redirect. Fix its DNS or exclude it. |
| "Certificate name mismatch" | The certificate does not cover the hostname you visited - commonly www was left out. Reissue covering both forms. |
| Works in Chrome on desktop, fails on a phone | The CA bundle is missing. Reinstall with the intermediate certificates included. |
| "The certificate does not match the key" | The CSR was regenerated after ordering. Ask the authority to reissue against the current CSR. |
| Validation email never arrives | The approver mailbox does not exist. Create admin@yourdomain.com in cPanel and resend, or switch to DNS validation. |
| Certificate installed but site still shows "Not secure" | Mixed content - the page is loading some assets over plain HTTP. See the companion article on fixing mixed content. |
| Issuance blocked by CAA | A CAA record names a different authority. Update or remove it in Zone Editor. |
Frequently asked questions
Do I need to pay for SSL?
No. A free certificate is included with every plan and provides exactly the same encryption strength as a paid one. Paid certificates add organisation validation, wildcard or multi-domain coverage, and a warranty - not stronger encryption.
Does the free certificate renew itself?
Yes, automatically, before expiry. There is nothing to schedule.
Does SSL slow my site down?
No. Modern TLS on our NVMe infrastructure has negligible overhead, and HTTPS is a prerequisite for HTTP/2, which usually makes sites faster.
Do I need a separate certificate for each subdomain?
The automatic certificate covers each subdomain that resolves to your account. A wildcard certificate is only necessary if you create subdomains dynamically.
Will SSL affect my search rankings?
HTTPS is a positive signal, and browsers label plain HTTP pages as "Not secure", which affects trust and conversions regardless of ranking.
