Support and documentation

Installation help, chain diagnostics and answers to the questions that come up before and after purchase. Technical support is included with every certificate.

Certificate checker

Inspect any domain or IP: issuer, validity, chain completeness, revocation and TLS versions.

Run a check

Deployment guides

Copy-paste configuration for Nginx, Apache and IIS, plus how to bundle the intermediate chain.

Open guides

Validation checklist

What documents DV, OV and EV need, and why a validation sometimes stalls.

Read FAQ

Talk to an engineer

Chain errors, HSTS mistakes, mixed content — send the domain and we will look at it.

Contact support
FAQ

Frequently asked questions

These cover most pre-sales and deployment questions. Click a question to expand the answer.

An SSL/TLS certificate binds a public key to a domain or organization and is signed by a publicly trusted Certificate Authority. Browsers use it to encrypt traffic and to confirm that visitors are talking to the real site rather than an impersonator.
Domain Validated certificates usually issue within 10 minutes to 2 hours. Organization Validated takes 1–3 business days and Extended Validation 3–5, because a human validates company registration, address and operational existence.
DV proves control of the domain and is enough for blogs, staging and internal tools. OV adds verified company details and suits business sites and stores. EV applies the strictest vetting and is used where identity assurance is a requirement, such as banking and payment portals.
Yes. A wildcard certificate covers every first-level subdomain of one name (*.example.com plus example.com). A multi-domain (SAN) certificate covers 3 hostnames by default and can be expanded to 100, across different top-level domains.
Browsers block access with a full-page security warning, so expiry is effectively an outage. We send reminders 14 days before expiry, escalate at 7 days, and can handle renewal and reinstallation for you.
Yes. A certificate is not tied to a single machine. Install the same certificate and private key on every server that terminates TLS for that hostname — including load balancers and CDN edges.
Deployment

Configuration examples

A certificate file usually contains only the leaf. Concatenate the intermediate chain into a single fullchain file before configuring the server, or some mobile clients will reject the connection.

Nginx
server {
    listen 443 ssl http2;
    server_name www.example.com;

    ssl_certificate     /etc/ssl/fullchain.pem;
    ssl_certificate_key /etc/ssl/private.key;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
    ssl_session_cache   shared:SSL:10m;
    ssl_session_timeout 10m;

    add_header Strict-Transport-Security "max-age=31536000" always;
}
Apache
<VirtualHost *:443>
    ServerName www.example.com

    SSLEngine on
    SSLCertificateFile      /etc/ssl/cert.pem
    SSLCertificateKeyFile   /etc/ssl/private.key
    SSLCertificateChainFile /etc/ssl/chain.pem

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    Header always set Strict-Transport-Security "max-age=31536000"
</VirtualHost>
Build and verify the chain
# Leaf first, intermediate second
cat www.example.com.crt intermediate.crt > fullchain.pem

# Verify the chain locally
openssl verify -untrusted intermediate.crt www.example.com.crt

# Count what the server actually sends
openssl s_client -connect www.example.com:443 -showcerts

Four checks after deployment

  • Chain complete: the server must send the leaf plus at least one intermediate.
  • Protocols: disable TLS 1.0 and 1.1; keep TLS 1.2 and 1.3 enabled.
  • Mixed content: every image, script and stylesheet must load over HTTPS.
  • Redirects: send HTTP to HTTPS with a 301 while preserving path and query string.

Stuck on a chain error?

Send us the domain. We will run the same checks your visitors' browsers do.

Contact support Check a domain
Support