An SSL error is rarely mysterious once you know what the browser is complaining about. The warning text is literal: it tells you whether the certificate is missing, expired, issued for another name, or whether part of the page is still loading over plain HTTP. The work is in finding which of those applies to your site.

Not secure: read the details

When a browser shows a not secure label, open the certificate information. If no certificate is presented at all, the domain may not be pointed at the server yet, or SSL may not be enabled for that site. If a certificate is presented, check its expiry date and the names it covers.

Also check the exact address. A certificate for example.com does not automatically cover www.example.com or a subdomain. Test both versions and decide which one should be canonical, then redirect the other.

Mixed content

Mixed content is the most common cause of a padlock that looks fine on the homepage but breaks on an inner page. The page is served over HTTPS, but an image, script, or stylesheet is still requested over HTTP. Browsers block the active parts and warn about the rest.

Open the browser console and look for the blocked URLs. Common sources are hard-coded http links in a theme, an old widget, a font import, or an image inserted before the site moved to HTTPS. Fix the source, then update the database so stored URLs use https. In WordPress, confirm that the site and home URLs in settings are correct, and resave permalinks after a bulk change.

Expired certificates

Certificates have a validity period. An expired one produces a full-page warning that visitors rarely click through. Free certificates are no exception; they still need renewal. If your site uses a free certificate, check the expiry date periodically and renew before it lapses rather than after.

After renewal, reload the page and confirm the new dates in the certificate viewer. If the old certificate is still served, the server may be caching it or the renewal may not have been applied to the right site.

Name mismatch

A name mismatch means the certificate is valid but was issued for a different hostname. The usual cause is a certificate for the bare domain being served on the www version, or the reverse. Subdomains have the same problem: a certificate for blog.example.com does not cover shop.example.com.

The fix is to issue a certificate that includes every name you actually serve, or to redirect all variants to the one name the certificate covers. If you recently changed DNS, wait for propagation before assuming the certificate is wrong; the browser may still be reaching the old server.

Redirect loops

A redirect loop shows as too many redirects, and it usually means two rules disagree. A common pattern is a plugin forcing HTTPS while the server or a proxy forces HTTP, or both the www and non-www versions redirecting to each other. If you use a proxy or CDN, check its SSL mode: a proxy set to a flexible mode can send HTTP to an origin that insists on HTTPS, and the two keep bouncing the request.

Test with a command-line tool that shows each hop, disable one rule at a time, and clear cookies for the domain. Do not add a third redirect rule to fix a conflict between two.

Chain and protocol errors

Some errors are not about your certificate itself but about the chain of intermediate certificates that proves it. A missing intermediate can work in one browser and fail in another, or fail on older phones and some command-line clients. The fix is to install the full chain provided by your certificate source, not only the leaf certificate.

Protocol errors are different: an outdated client may not support the minimum TLS version the server requires. Current browsers are fine; very old devices and embedded tools may not be. Do not lower the server's security to satisfy one legacy client unless that client matters.

When to contact support

Check a few basics before opening a ticket:

  • Does DNS point to the right server?
  • Does the certificate cover the exact hostname you are testing?
  • Is a redirect rule fighting another rule?
  • Does the error appear in more than one browser?

If those are correct and the error persists, contact support with the URL, the exact error text, the browser or tool you used, and a screenshot. That saves a round trip.

For background on how certificates work and what the free option covers, read free SSL explained. To set up a certificate on a BadilHost site, follow enable free SSL. If your domain is not connected yet, start with connecting a domain and nameservers. When the certificate is in place, create a free account and serve your first site over HTTPS.

Related reading: How free SSL works · Enabling free SSL

Create your free account — 5 GB disk, free SSL, no card required.