Newest KB Articles in SSL

Renewing an SSL certificate

Thu, 13 May 2010 23:05:50 GMT

Renewing a SSL certificate.

SSL certificates can be renewed up to 60 days prior to certificate expiration. To determine whether a certificate is eligible for renewal, go to the SSL Certificates tab in Control Panel and check the certificate status. If there is a "Renew" link next to the expiration date, the certificate can be renewed.

To renew:

Log into your WinHost control panel, and go to the Site Manager/SSL Manager.
Click on the button “Generate a New CSR”.
Take that CSR and give it to your SSL Authority/Provider so that they can generate you a new SSL certificate.
If you purchased the SSL certificate from the WinHost control panel, go to the tab SSL Certificates.
Navigate to the SSL certificate and click on the link “Renew” under the Exp. Date column.
Paste the newly generated CSR on the text box and click on “Continue”.
This will generate you a new SSL certificate.

Note: We recommend that you renew your certificate as soon as possible. Depending on the SSL Authority you purchase it from, the renewal period is typically 60 days prior to the actual expiration date on the certificate. Renewing your certificate within its renewal period (60 days) will affect the life cycle of your SSL certificate.

Note: If you have changed any of the information on the CSR when you re-generated it, you will need to request a new SSL certificate. This will take you back to the window as if you are ordering a new SSL certificate for the first time. Since you are ordering a new SSL certificate, this will affect the life cycle of your SSL certificate.

Installing the renewed SSL certificate

Once you have received the new SSL certificate, log back into your WinHost control panel and navigate to the Site Manager/SSL Manager.
Scroll down until you see the text box labeled “Install SSL Certificate”. Copy and paste the SSL certificate in that text box and click on the Submit button.

Note: When Copying and Pasting CSR certificates or SSL certificates ensure you include the certificate Header and Footer.

CSR Header/Footer

-----BEGIN NEW CERTIFICATE REQUEST-----
-----END NEW CERTIFICATE REQUEST-----

SSL Header/Footer

-----BEGIN NEW CERTIFICATE-----
-----END NEW CERTIFICATE-----

SSL "Site Seals"

Thu, 25 Mar 2010 22:54:24 GMT

If you wish to use the "site seal" icon for your SSL provider on your site, here are links to the seals:

Where is the SSL certificate sent?

Fri, 19 Mar 2010 23:56:43 GMT

The SSL certificate will be sent to the Administrative Contact email that you entered during the SSL purchasing process.

If the Administrative Contact email does not exist, but you have access to the Administrative Contact email domain name, please create the Administrative Contact address and contact the billing department to resend the certificate.

What can I do if I selected the wrong Approver email address?

Fri, 19 Mar 2010 23:48:38 GMT

Unfortunately, the Approver email address cannot be changed once the certificate order is submitted.

If you have access to the Approver email domain, please create the Approver email address and use the resend button in the Control Panel SSL Manager to resend the Approver email.

Do not regenerate the CSR - doing so will remove the original private key on the server and the certificate installation will fail.

If you cannot create the Approver email, please contact our Billing Dept to cancel the order. Once the order is canceled you can begin the process again.

SSL common names

Sat, 13 Mar 2010 01:08:57 GMT

The Common Name is the name or URL you wish to make your secure connections through. As you can see in the examples below, there are several different options. It's important to note that when you choose one option, others will not work.

Common Name: www.HostingAccountDomain.com
If you choose the common name www.HostingAccountDomain.com:

https://www.HostingAccountDomain.com is secure
https://HostingAccountDomain.com will cause a "Common Name Doesn't Match" browser warning

Common Name: secure.HostingAccountDomain.com
If you choose the common name secure.HostingAccountDomain.com:

https://secure.HostingAccountDomain.com is secure
https://HostingAccountDomain.com
and
https://www.HostingAccountDomain.com will cause "Common Name Doesn't Match" browser warning

Common Name: HostingAccountDomain.com
If you choose the common name HostingAccountDomain.com:

https://HostingAccountDomain.com is secure
https://www.HostingAccountDomain.com will cause "Common Name Doesn't Match" browser warning

Common Name: *.HostingAccountDomain.com
If you choose the common name *.HostingAccountDomain.com:

https://anything.HostingAccountDomain.com is secure
https://HostingAccountDomain.com will cause "Common Name Doesn't Match" browser warning

How do I order and install an SSL Certificate?

Sat, 13 Mar 2010 00:32:55 GMT

SSL Certificate	Our Annual Price	Warranty
RapidSSL	$29	$10,000
RapidSSL Wildcard	$169	$5,000
GeoTrust QuickSSL Premium	$134	$100,000
GeoTrust True BusinessID	$184	$250,000
GeoTrust True BusinessID with EV	$284	$500,000
GeoTrust True BusinessID Wildcard	$489	$125,000

You can buy SSL certificates from WinHost at a significantly discounted prices. See the chart below to compare our prices to the retail prices of the SSL providers:

SSL Certificate Our Annual Price Warranty

RapidSSL $29
$10,000

RapidSSL Wildcard $169
$5,000

GeoTrust QuickSSL Premium $134 $100,000

GeoTrust True BusinessID $184 $250,000

GeoTrust True BusinessID with EV $284 $500,000

GeoTrust True BusinessID Wildcard $489 $125,000

SSL certificates ordered through WinHost can be used on your WinHost sites or sites hosted elsewhere.

Ordering an SSL certificate for a WinHost site

Part one - generate a CSR

The first thing you have to do is generate a CSR. A CSR is a public key that we generate on the web server. It validates the specific information about the web server and your organization. You will use the CSR in the second step of the ordering process.

Log in to Control Panel and click the Sites tab.
Click the Manage link for the domain you are ordering a certificate for.
Click the SSL Manager icon.
Complete the CSR information form:

Common Name: See this Knowledge Base article for info on common names.
Organization/Name: Name of the company.
Organization Unit: Name of the department applying for the SSL certificate.
City/Locality: Name of the city/locality your company resides in.
State/Province: State or province your company resides in.
Country: Country your company resides in.

Click the Submit CSR Information button

The next page you see will contain a text block that begins with:

-----BEGIN NEW CERTIFICATE REQUEST-----

This is your CSR.

Part two - submit the certificate order

Copy the entire text of the CSR, including the beginning and ending lines.
Click the SSL Certificates tab.
Click the Order New SSL Certificate button.
Select the type of certificate you would like to order.
Paste the CSR text into the Paste your CSR box.
Click the Continue button.

Next you will choose an "approver email" from the dropdown list that appears on the next page. It is very important that you choose an address where you can receive email! If you cannot receive email at any of the addresses listed, you must set up a mailbox on one of the listed addresses before you proceed.

Verify the admin contact information, and make any necessary changes.
Click the Continue button.
On the next page, verify that the certificate information is correct and click the Order New SSL Certificate button.

Next you will receive an email message from the certificate issuer at the "approver email" address. Follow the instructions contained in that email.

Part three - install the certificate

When you complete the verification required in the certificate issuer's email, they will send you the SSL certificate. The certificate is similar to the CSR in format, beginning with:

-----BEGIN CERTIFICATE-----

followed by a text block.

Copy the entire text of the certificate, including the beginning and ending lines.
Log in to Control Panel and click the Sites tab.
Click the Manage link for the domain you are ordering a certificate for.
Click the SSL Manager icon.
Paste the certificate text into the second box on the page (the empty one).
Click the Submit Certificate button.

Note: Make sure you paste only the Web Site Certificate. Some Certificate Authority (CA) will offer you both the Intermediate and Web Site Certificate. The Intermediate Certificate should already be installed on the server and trying to install the Intermediate Certificate from the control panel will cause the process to fail.

That completes the SSL certificate process.

* * *

To order an SSL certificate for use on another server

The process is the same as part two above, but you must generate your own CSR on the server where you will install the certificate.

If you are ordering a RapidSSL or RapidSSL Wildcard certificate, you can find CSR generation instructions here.

If you are ordering a GeoTrust QuickSSL or GeoTrust QuickSSL Premium certificate, you can find CSR generation instructions here.

After you receive the certificate, continue with part three above.

Note that we cannot assist in generating CSRs for non-WinHost servers!

SSL certificates, intermediate certificates and browser compatibility

Fri, 07 Aug 2009 18:45:40 GMT

Some SSL certificates can work properly in Internet Explorer but create errors or warnings in Netscape, Firefox and other browsers (or vice versa).

Why are some certificates incompatible with some browsers?

Every web browser checks a list of "Trusted Root Certificates" in order to establish a secure connection. These lists are generally the same between the different browsers, but discrepancies can occur (one browser lists a Trusted Root certificate or intermediate certificate while another browser does not). Additionally, all browsers do not handle certificates in the same way.

An SSL Certificate will only be recognized by a browser if the root certificate the SSL certificate uses to establish "trust" is listed in the "Trusted Root Certificates" of the browser. If that chain of trust cannot be established, the visitor will see a warning message and may be unable to establish a secure connection to your site.

Important note: We trust the certificate authorities listed on the Microsoft Root Certificate Program Members page. The root certificates from these authorities are already installed on the server. Other third-party root certificates are NOT supported.

Intermediate certificates and certificate chains

To understand why SSL errors may occur it is necessary to have a general overview of how SSL certificates work.

SSL certificates are issued by several companies (referred to as "certification authorities") at different price levels. Typically the most costly certificates are what is known as "single root certificates." Less costly certificates are often "chained root certificates," which consist of one or more "intermediate certificates" that point to a root certificate.

Single root certificate

A single root certificate is a certificate that is issued for your domain which "trusts" the issuing authority's root certificate. So for example, if you purchased a single root SSL certificate from the ABC company, your certificate would trust the root certificate named ABCRootCertificate in your browser's Trusted Root certificate list. The "chain of trust" looks like this:

ABCCertificateForYourDomain -> ABCRootCertificate

"Chained root" certificate

A chained root certificate is a certificate that is issued for your domain which "trusts" one or more "intermediate" certificates, which in turn trust a root certificate (which may or may not be issued by the same certificate authority). So for example, if you purchased a chained SSL certificate from the XYZ company, your certificate would trust the intermediate certificate, which in turn trusts a root certificate in your browser's Trusted Root certificate list.

XYZCertificateForYourDomain -> XYZIntermediateCert1 -> ABCRootCertificate

As you can see, a single root certificate is a direct path to the root certificate, and a chained root certificate is a less direct path.

We support third-party intermediate certificates, but they must be from a trusted root certificate authority. The most common intermediate certificates are already installed on the server. We will contact you if we need a copy of the intermediate certificate.

The problem with certificate names

Some certification authorities have issued their own root certificates which conflict (or will in the future) with earlier intermediate certificates. For example, they may have issued a chained root SSL certificate which has a chain of trust like this:

XYZCertificateForYourDomain -> XYZIntermediateCert1 -> XYZIntermediateCert2 -> ABCRootCertificate

In this example the XYZIntermediateCert1 certificate trusts XYZIntermediateCert2, which in turn trusts the ABC root certificate. So far so good.

But let's say the XYZ company decides to issue their own root certificate named XYZIntermediateCert2, and has XYZIntermediateCert2 added to the lists of Trusted Root certificates used by the browsers. This is where the problems arise. If, for example, your older XYZ company certificate still uses ABCRootCertificate as the root:

XYZCertificateForYourDomain -> XYZIntermediateCert1 -> XYZIntermediateCert2 -> ABCRootCertificate

But the browser now recognizes the new XYZIntermediateCert2 as a root certificate, so in the chain of trust, the browser will now stop at XYZIntermediateCert2, since that is listed as a Trusted Root certificate.

SSLCertificateForYourDomain -> XYZIntermediateCert1 -> XYZIntermediateCert2

Which breaks your certificate, because it still considers XYZIntermediateCert2 to be an intermediate certificate, not a root. But as far as the browser is concerned, XYZIntermediateCert2 is now a root certificate, so it stops there and will not look further for the root required by your certificate.

Would a certification authority give a new root the same name as a previous intermediate certificate?

Unfortunately, some, such as Comodo and GoDaddy, already have. GoDaddy recommends disabling their new root certificate, since it is designated for "future use." We have done so, but as soon as they begin to issue certificates that use the new root, we will have to enable it on the server, which will break all old chained root certificates that use the new root as an intermediate certificate.

GoDaddy has indicated that they will contact all certificate holders that may be affected by the change when it occurs and provide a solution, but we still expect that some of our users who have purchased SSL certificates from GoDaddy will experience problems when the GoDaddy root certificate is activated.

In general, we recommend the use of "single root" certificates, such as those issued by:

RapidSSL.com
VeriSign.com
thawte.com

Can you export my SSL certificate for use on a different server?

Fri, 07 Aug 2009 18:43:23 GMT

We can export your certificate and private key if you wish to use it on another server, however, we recommend against doing so.

If we export your certificate and you install it on another server, the private key will then be in the hands of more than one party, and will have been used on more than one server, which is not ideal security practice.

Most SSL providers can "re-key" your certificate in the event of a server move. When they do so, the private key that we used on our server will no longer be valid, which is preferable for your overall security.

Contact your certificate provider for details regarding re-keying. It is usually a simple matter of sending the provider a CSR from your new server.

If you still want us to export your SSL certificate with the private key, please contact support for assistance.