Installing a free Let's Encrypt certificate

The Let's Encrypt service allows you to use a free SSL certificate

  • the service is available to Windows shared-hosting customers starting from 12.09.2016
  • the service does not require a dedicated IP address
  • the certificate is issued for 90 days and is automatically renewed
  • Let's Encrypt does not issue wildcard certificates

1. Go to the site properties, select the SSL tab and click Install free certificate from Let's Encrypt:

instalacja_darmowego_certyfikatu_lets_encrypte_01.png

2. Select the address on which the certificate is to be installed and, if necessary, additional domains (you can add more sub-domains; hold CTRL + left mouse button to select them). After reading and accepting the Let's Encrypt terms of service, check I have read and agree to Let's Encrypt certificate. Finally click Create and install Let's Encrypt certificate.

instalacja_darmowego_certyfikatu_lets_encrypt_02.png

3. When the certificate is installed successfully, you will see the message below.

certyfikat_lets_encrypt_powodzenie.jpg

WARNING!
  • The domain on which the certificate will be installed must be active and point to the site on the HostedWindows.pl server

Automatic redirect to SSL

To force HTTPS traffic, add the following entry to the <system.webServer> section of the web.config file:

<rewrite>
<rules>
<rule name="Let's Encrypt Renew" stopProcessing="true">
<match url="^\.well-known(.*)"/>
<action type="None"/>
</rule>
<rule name="Redirect to HTTPS" stopProcessing="true">
<match url="(.*)"/>
<conditions><add input="{HTTPS}" pattern="^OFF$"/>
</conditions>
<action type="Redirect" url="https://{HTTP_HOST}/{R:1}" redirectType="SeeOther"/>
</rule>
</rules>
</rewrite>

If you use this method, make sure you are not using absolute paths such as http://domain/images/logo.jpg, as this may trigger a mixed-content warning.

The first rule allows the automatic renewal of a free Let's Encrypt certificate installed through the control panel. If you use your own certificate, only the second rule is needed to enforce HTTPS.