How Our SSL Certificate Installation Works

Certificates are issued to cover every hostname actually served, including the apex and www forms and any subdomain in use, because a name absent from the certificate produces a browser warning that no amount of correct configuration elsewhere will suppress. The full chain is installed, not just the leaf: a missing intermediate validates in desktop browsers that cache it and fails on other clients, which is why it is so often reported as intermittent. Configuration disables obsolete protocol versions and weak cipher suites, enables forward secrecy, and sets HSTS only once HTTPS is confirmed working across every hostname, since HSTS is difficult to reverse. HTTP is redirected to HTTPS in a single hop rather than through a chain. Mixed content is found and fixed at the source rather than masked by an upgrade header. Renewal is automated with the renewal itself monitored, because the failure mode is a silent expiry, and expiry alerting is set well ahead of the date. Installation is verified from outside against an external checker on every hostname, not from the control panel.