Finding out your site is inaccessible because a certificate has expired is the last thing you want to happen. We do more than just issue a certificate; we manage the entire lifecycle—from selection and issuance to deployment, automatic renewal, and expiration alerts—ensuring long-term availability.
Free certificates can handle basic needs. However, paid certificates are necessary when you need to display your company name in the browser’s address bar, require integration with corporate procurement processes, or need coverage for numerous subdomains. Below, we clarify how to choose, install, and avoid common issues.
How to Choose Certificate Types
| Type | Validation Method | Browser Display | Use Case | Reference Price |
|---|---|---|---|---|
| DV (Domain Validation) | DNS or File Verification | Security Padlock Icon | Most websites, including WordPress, e-commerce, and corporate sites. | Free – ¥300/year |
| OV (Organization Validation) | Domain + Business Identity Verification | Company Name Shown | Corporate websites, procurement processes requiring compliance. | ¥1,200 – ¥2,500/year |
| EV (Extended Validation) | Rigorous Identity Verification | Company Name Highlighted | High-trust scenarios such as finance and payment platforms. | ¥2,500 – ¥5,000/year |
Brands and Pricing
| Brand | Features | Suitable For |
|---|---|---|
| Let’s Encrypt | Free, 90-day validity, high automation, supports wildcard certificates. | Default choice. Sufficient for the vast majority of commercial websites. |
| Cloudflare Origin CA | Free, encrypts traffic only between Cloudflare and the origin server. | Sites already integrated with Cloudflare (visitor-to-edge traffic remains free DV). |
| ZeroSSL | Generous free tier, supports both ECC and RSA certificates. | Requirements for ECC certificates or avoiding Let’s Encrypt rate limits. |
| DigiCert / GlobalSign / Entrust | Commercial brands offering OV/EV, with standardized after-sales trust and contract terms. | Corporate procurement, scenarios requiring formal invoices, or specific contractual requirements. |
The quote for a paid certificate will specify: brand, type, validity period, quantity (including SAN and wildcard rules), whether it includes enterprise insurance, and the renewal price. Inconsistent renewal prices compared to first-year prices are an industry norm. The second year’s price is listed separately in the quote; it is not simply cheaper in the first year.
What Deployment Entails
“Configuration complete” does not mean merely uploading the certificate files. Our complete process includes:
Certificate Chain Completion
Many sites upload only the server certificate, missing the intermediate certificates, which causes browsers on certain devices to report “Invalid Certificate.” We use SSL diagnostic tools to verify the complete chain.
Enforcing HTTPS
We configure 301 redirects, enable HTTP/2, and set HSTS policies according to each site’s requirements. Redirects preserve paths and parameters, ensuring no links are lost.
Mixed Content Cleanup
If even one image or script on a page uses http://, the lock icon will not appear, and security scores will drop. We identify these instances individually and update them to https or protocol-relative URLs.
OCSP Stapling
This reduces the overhead of clients querying the CA for certificate status each time and improves handshake speed. Availability depends on server support.
Multi-Domain and Wildcards
We handle the application and deployment of SAN certificates (one certificate covering multiple domains) and wildcard certificates (*.example.com), avoiding the need for separate certificates for each subdomain.
Reverse Proxy Resolution
When using front-end CDNs, load balancers, or multiple backends, the certificate is placed at the outermost layer, with the correct configuration of the trust chain.
Automatic Renewal and Alerts
| Scenario | Solution |
|---|---|
| Virtual Hosting / cPanel / Plesk Panel | The panel’s built-in AutoSSL automatically issues and renews certificates once enabled. We configure automatic renewal and verify that an actual renewal succeeds. |
| Baota Panel (BT Panel) | Application and renewal via the panel’s SSL page can be automated; we synchronize and configure the renewal cron jobs. |
| Self-Managed Server (Certbot) | Uses certbot timer/cron for scheduled renewal + nginx deploy hook; after configuring webhooks or scripts, the service automatically reloads upon renewal. |
| Paid Certificates (Primarily Manual Renewal) | We set up multi-level alerts: 30 days, 14 days, 7 days, and 3 days prior to expiration, notifying you in advance and assisting with the renewal process. |
Common Troubleshooting
| Issue | Common Cause | Resolution |
|---|---|---|
| Browser displays “Not Secure” despite HTTPS URL | Mixed content exists (http:// resources on an https page) | Locate and update resource URLs, then re-test the score |
| Invalid Certificate / ERR_CERT_COMMON_NAME_INVALID | Certificate domain mismatch or missing intermediate certificates | Re-issue the certificate and complete the certificate chain |
| Accessible on some devices but not others | Incomplete certificate chain (older devices are more sensitive to missing intermediate certs) | Complete the chain configuration |
| Site performance degradation | HSTS preloading blocking HTTP fallback, or overly strict TLS parameters | Adjust TLS versions and cipher suites; adjust HSTS max-age |
| API / App requests failing | Client does not trust self-signed or private CA certificates | Switch to a public CA certificate, or import the CA certificate into the client’s trust store |
| CDN-side errors | Inconsistent origin fetch protocol or encryption mode configuration | Unify encryption configurations between CDN and origin server |
Service Process
- Assess Current Status
Analyze existing certificate types and validity periods, list covered domains, identify deployment locations (origin server / CDN / load balancer), check for mixed content, and review history of expiration incidents.
- Proposal & Quotation
Provide selection recommendations and clear pricing (including renewal rates). Differences between free and paid options are explicitly stated; unnecessary paid services are not recommended.
- Issuance & Deployment
DV certificates use DNS or file validation (we handle this if granted permission); OV/EV certificates require your company documentation, which we assist in submitting. After issuance, we complete the certificate chain, enforce HTTPS, and clean up mixed content.
- Verification & Delivery
Verify using external testing tools from multiple nodes, confirm the browser lock icon appears, ensure consistency across mobile and desktop clients, and verify no mixed content warnings remain.
- Renewal Mechanism
Configure automatic renewal and perform a simulated verification test; set up multi-level expiration alerts for paid certificates.
Frequently Asked Questions
Is the free Let’s Encrypt certificate sufficient?
In most cases, yes. Maintained by ISRG, it is fully trusted by mainstream browsers, issued for free, and supports automation. The only caveat is its 90-day validity period; therefore, automatic renewal must be properly configured, otherwise, expiration will render the entire site inaccessible. This is why we recommend it as the default solution and always perform simulated renewal verifications.
Do certificates affect SEO?
HTTPS is one of the ranking signals, and browsers explicitly mark HTTP sites as “Not Secure.” When migrating an existing HTTP site to HTTPS, you must implement proper 301 redirects and update the sitemap protocol; otherwise, duplicate content issues may arise. For detailed migration plans, see Server Migration.
Can I purchase the certificate separately and install it myself?
Yes, you can. However, many customers discover after installation that the certificate chain is incomplete or automatic renewal is not configured, leading to expiration issues within a month. The price difference of the certificate itself is far less than the cost of troubleshooting. We recommend at least allowing us to handle the deployment and verification.
Will renewal prices increase?
Commercial certificates often offer promotional pricing for the first year, with renewals billed at the standard catalog price. This is an industry norm. Our quotation will list both the first-year and renewal prices, allowing you to assess whether continuing is worthwhile. In some cases, switching providers or opting for a DV certificate in the second year may be more cost-effective, and we will advise you accordingly.
Do you support wildcard and multi-domain certificates?
Yes. Let’s Encrypt free certificates support wildcards (requiring DNS-01 validation), while multi-domain certificates use SANs. You will need to provide DNS platform verification permissions; we automate the issuance and renewal process via DNS API.
Related Services
Annual/Monthly Website Maintenance PlansIncorporate certificate expiration into monitoring alerts, eliminating the need for quarterly manual checks
Cloud Server Managed ServicesUnified certificate management across load balancers, reverse proxies, and multiple nodes