A suitable certificate lets visitors use HTTPS on your website’s addresses. The term “SSL certificate” remains common, but modern connections use TLS. HTTPS protects data in transit and lets the client verify that the presented certificate matches the requested name. It does not guarantee that a website is free of malware or that its content is trustworthy.
Start with the addresses people actually use
List the names visitors open: example.com, www.example.com, a store, a member area or another associated domain. The main domain and its www version are two distinct names. Check that both are covered where required, even when one HTTPS address redirects to the other. A certificate does not create the website, add a domain to your hosting account or configure your DNS.
Understand the three coverage patterns
- One specific name: the certificate covers the listed name, such as
www.example.com. Do not assume thatexample.comorshop.example.comis also included. - Several names: one certificate can contain multiple SAN entries, short for Subject Alternative Name. It can cover
example.com,www.example.comandexample.orgif those names are included and validated. SAN is the mechanism that identifies the covered identities, not a higher security tier. - A wildcard name:
*.example.comcovers one level of subdomains, such aswww.example.comandshop.example.com. That entry alone covers neitherexample.com, norcheckout.shop.example.com, nor another domain. A certificate can combine specific and wildcard entries.
Choose according to the names you need and how they will be managed. A wildcard is not automatically preferable to several specific names. To add a name that is not already covered, obtain a certificate that includes it and put it into service; the names in an already signed certificate cannot simply be edited.
Free or paid: assess the actual requirement
A free certificate can suit a business website. Let’s Encrypt issues domain-validated (DV) certificates, including certificates for multiple names and wildcards. Its wildcard certificates require DNS validation. Offerings can differ in organization validation, support and management arrangements; price alone does not determine your website’s protection. Check what your current service provides before ordering.
Plan installation and renewal
A new subdomain already covered by a wildcard may not need a certificate reissue for its name. The website or server serving it must still present the appropriate certificate. Name coverage, installation and renewal are separate considerations.
In cPanel, if your service provides SSL/TLS Status, review the covered names and certificate status. Interface labels can vary. Confirm how renewal and installation of the renewed certificate are handled. Automation depends on factors such as continued validation eligibility; it does not remove the need to monitor errors or expiry.
Account for a proxy or CDN
If Cloudflare or another proxy is involved, distinguish the visitor-to-proxy connection from the proxy-to-origin connection. The certificate visible in the browser does not, by itself, establish that the origin connection is properly protected. Cloudflare’s Full (strict) mode also validates the origin certificate; its prerequisites must be met before changing the mode.
Have your configuration reviewed
If a warning appears, follow our certificate-warning guide without bypassing verification. For a Nuagerie service, send the affected names and your plans through your Client Area. When preparing a new website or migration, talk with our team about coverage and renewal. Never attach a private key to an ordinary support request.
References: Let’s Encrypt certificates, cPanel SSL/TLS Status and Cloudflare Full (strict).
