SSL certificates
Every domain gets a free SSL certificate on its first visit, renewed by itself. HTTP always goes to HTTPS. Nothing to buy or upload.
Updated 17 Oct 20262 min read
Every domain you connect gets a free SSL certificate, so it opens with https:// and the padlock. You don't buy, upload or renew anything: the certificate comes on the first visit once your domain points here and is proven yours, and it renews by itself. Every visit to http:// goes to https://.
How it works
You add your domain, and it's proven yours.
Its DNS points at us. The Domains tab says it points here, and that its certificate comes with the first visit.
The first visit asks Let's Encrypt for a certificate, the free certificate authority most of the web uses. That takes a few seconds. The domain shows Getting SSL, then goes live.
Before it ends, the certificate is renewed. The domain shows SSL renews by itself.
Free addresses on tanzahost.co have SSL from the start.
Example: Asha's two names
Asha connected duka.co.tz, and www.duka.co.tz came with it. When both pointed at us, she opened https://duka.co.tz on her phone. The first load took a moment longer while its certificate was made. https://www.duka.co.tz got its own on its first visit, and redirects to duka.co.tz. She never saw a "not secure" warning, and she'll never renew anything by hand.
Only proven domains get one
A certificate is made only for a domain on our list of proven customer domains. A name nobody proved gets nothing. That stops anyone from pointing a domain they don't own at us to get a certificate for it, and it keeps the certificate authority from limiting us.
If something goes wrong
We watch every certificate from outside. If one is within 14 days of its end and hasn't renewed, our team is alerted, every day until it is.
An expired or missing certificate stops the domain counting as live: your free address no longer redirects to it, so visitors aren't sent to a broken padlock.
A second certificate authority is set up, ZeroSSL, used if Let's Encrypt can't issue.
CAA records
A CAA record says which certificate authorities may issue for your domain. If your domain has one that names only another authority, our certificate can't be issued. Fix it in your DNS: add CAA records for Let's Encrypt and ZeroSSL, or remove the old one. On our nameservers, the DNS tab's template Only our certificate authorities (CAA) adds both for you, beside any CAA already there.
Behind Cloudflare's proxy
If you use Cloudflare's proxy (the orange cloud), keep it off until the domain shows SSL active here, then turn it on. Set Cloudflare's SSL mode to Full (strict), never Flexible: with Flexible, visitors go round in circles between http and https. See Connect Cloudflare.
What isn't offered yet
Wildcard certificates, for every name under a domain at once.
Uploading a certificate of your own.
Each name you add gets its own certificate, so shop.duka.co.tz gets one as soon as it's added and points here.