Having difficulties going SSL

SSL certificates on shared hosting, same IP

[explorador]

Hi webmasters, I'm going https on all of my sites, but having issues and still not clear on how to solve it. While I can go specific on my case I will go a bit general on this so others can find some light too.

What do you need to go https?. You need a website (sure) a SSL certificate (free or paid), then configure the certificate on your server and do some changes so everything that points to your server ends up as https pages with 301 redirects. You will need to renew your certificate after it expires (you can get ssl for 30, 90 days and a year). I have covered all of that but experiencing issues.

The easiest way, Let's Encrypt. Their initiative allows you to get a free certificate, free as in "free" no tricks, why? there is a foundation, people moving white strings etc and donations so this can happen and the web can become a more secure place, so no tricks, it's free. Here you have two basic choices

1. Let's encrypt plug in.
This would appear on your webserver admin panel (example: cpanel), then you follow the specific documentation and it's done, it's the easiest way, I can't provide any more info about this because I don't have this feature and also, their documentation is pretty easy, you can find it online). Yes you can update and renew your certificate there too. There are tutorials on setting up a cron job to do the same, but that's something else.

2. Let's encrypt services on diff sites. There are some websites offering free tools (as in wizards) so you can enter there your info, generating our own CSR first on your server and pasting the code on their site. Some of those websites do this for you (just enter your url and wait), from the result of any of those processes you follow the instructions and then you have to validate your website to prove you are in charge, the website belongs to you. Once this is done the sites will give you the certificate for you to install on your admin panel (paste the cert), easy.

Now what lots of people are having trouble with: SSL on shared hosting.
So you follow the instructions, set up your SSL on your server and it works, but you have 3, 5, 10 websites on a shared hosting account. All the websites share the same IP address.

A. You can have one certificate per website. This can be expensive.
B. One free certificate for all your websites. Free = free but not all options might be available. So far after reading this is possible, and actually being able to set this up, I'm having trouble on making it work.
C. One separate free certificate for each website. Free = free. On some services you can get your free certificate, on others they can tell you "other certificate was already generated" and this is because your IP might have been detected on their system.

The problem I have found, and I'm reading lots of people are facing is about the same ip on shared server.

I have created a single certificate for all the websites, and also tried using a separate certificate for each website. Anyway, any of those two options ends up on the same issue. I have the following structure in my server

/ root folder (here are the files for my main website), web0
/ root folder / website1 / files for website1
/ root folder / website2 / files for website2
/ root folder / website3 / files for website3

After installing the certificate for site #1, I could see it was actually working, all fine. Then installed certificate for site #2, now I had issues. I got warnings on site #2 because the certificate belongs to another website "website#1". I didn't want to try yet on my main site.

Then I removed everything and tried on my main website (web0). Again, it worked, but then when I installed certificate for website #1 and #2, whenever I visited those sites using https, a warning was displayed about the cert belonging to web0. It seemed to me only one certificate can be applied effectively at once. In my panel I can make any certificate "primary" any time, and yes the same issue, I would get a warning unless I'm visiting that website exactly.

Read somewhere about creating a certificate for all my sites, so instead of feeding website1, I would enter website1, website2, website3 etc while generating the CSR, then generate the final certificate. Did that work? nope, it didn't. There is documentation some functions like SNI won't work on every browser, checked mine on the list and they are capable, but still doesn't work. So it's something on the server, the limitation of having just one ip.

So, one IP and you are stuck on your shared hosting? read articles stating it is possible, but you have to change things on your server software, I don't need to describe those are changes your server admin won't let you perform on the server. So that options are valid for shared servers you admin yourself.

Many articles and forum responses point to setting up:

A. Each website on diff ip addresses
B. Each website on diff ports (doesn't sound good to me)

But those might not be valid options for you, or anybody, because extra ips mean more money and several websites/clients don't exactly qualify on budget terms. Besides, I'm not saying we should always stay with free options but hey, is valid, and the SSL certs are not free, it doesn't make sense to just spend money without valid justifications or reasons.

Where I'm standing now. I've tried several approaches, but can't make this work, any help will be appreciated. Only some of my websites IMHO qualify on spending extra money going SSL, the rest... don't, so I'm researching to stay away from buying extra ip addresses. I have read lots (lots!) of pages and forum threads finding people who say this can be done, but there are no details, no info I can follow that works. Any light will be appreciated.

Is there a way to set this up for shared hosting? same ip address? what am I doing wrong?

I "managed" to get it working and test it on some urls, but then I got the problem of websites loading the wrong information, how? well the domain name became useless as everything was being loaded from the ip address (regardless of what site was being called) this has nothing to do with my htaccess. So, https on site#1, site#2 or site#3 loaded the root info on site0.

Thanks in advance any light will be appreciated.

[TorontoBoy]

I recently started up a new site on my shared host, and chose https. Used Let's Encrypt. The icon on cpanel was easy. For your site click to go from red to green. Easy peasy, I was https.

I don't really know much about the guts of the certificate and Let's Encrypt, and that's the point: click, easy-peasy and you are done.

Am I wrong?

[explorador]

No TorontoBoy you are not wrong, I've seen documentation stating it is that easy, so after lots of readings I know what you are saying works. Unfortunately my host doesn't provide automated Let's Encrypt functionality. So for now it's all manual on my end. I'm trying to solve it because at this moment moving to another host is not a good option due to several reasons, and I also would like to learn the process. Thanks (wish I had that option, I will keep talking to the host provider).

[lucy24]

extra ips mean more money

Double-check on this point with your specific host. Mine charges for IPv4 addresses, but IPv6 is free.

[explorador]

Thanks @lucy25, didn't think of that before.

Update: the hosting provider just replied, they offer AutoSSL on other servers so my account will be migrated, they explained this solves going SSL on a click and now I'm reading articles about it (about how easy it is), basically it's the same as Let's Encrypt plugin but this works using Comodo AFAIK. I wasn't aware of AutoSSL, all my readings brought me to some brands and Let's Encrypt, so this is new for me.


*Why difficult if it can be done easier? on a personal note, I consider it's good to know because not always the hosts solve it or provide the tools. I will keep the thread updated when I have first results.

[explorador]

Done, now going HTTPS. I read, did my homework, and honestly didn't like many of the articles, tutorials and forum threads I found. Won't go into details but will post what I think can help others.

- - - - - - - Generalities - - - - - - -
Easiest way going https: (if you are not buying certificates as extra service)
If Let's Encrypt is supported by your host and it appears on your panel as a plugin then you are one click away, the rest depends on your CMS, your code, etc. If they don't support Let's Encrypt plugin then ask for Auto SSL.

The manual way if you can't pick any of the options above, then you can install your certificate yourself. Search (won't post direct links here), Comodo offers an online wizard at this time, free. Let's Encrypt is supported via several websites offering also their online wizards. Follow the instructions, get your certificate and install it, done. Sure you will have to validate that you own your domains. This would have to be done every 30 or 90 days, whatever your expiry date is for your certificates.

WHAT IF you have several websites on a shared hosting account? this was my case and the options above only worked for me one site at the time, not all at once. Whenever I installed a certificate on domain A, it worked, but when I installed another on domain B,C or D, only that one worked, the rest went off. I would get errors on site A because the certificate belongs to site B and so on. In such cases you need extra IPs, you can buy them with your host, or do as Lucy24 says, IPv6.

I found tutorials and whatever etc online explaining how to get a -free- certificate that works on several websites (on shared hosting) with the same IP. Honestly the description and instructions were not clear enough and even I followed the details and tried variations, it didn't work for me. Many tutorials explain what you need, I checked with my server and it was all there, but it didn't work, yes filling all the domains, etc blah blah, didn't work for me, I won't post in detail all the variations I tried, it would be impossible. So, your host and server should support some options for this to work, I can't detail all of that here you try it yourself and contact your host provider, they even might tell you "yes" when it doesn't work, support works that way sometimes.


The hosting company providing the hosting to my websites didn't support any of this (or the last options fully) on the server I was in, so they migrated my account to another server that had all the support. Things got complicated but at the end I know have AutoSSL on my Cpanel account. Migrating your websites can be easy sometimes, other times can be a nightmare and it depends on your code, cms and your hosting company. Not all companies have all the servers running with the same specs and software so check and try.

Good luck.