The free SSL certificate (Let's Encrypt)

How to get the free SSL certificate

1. Order a hosting plan. The certificate comes with the plan; there is no separate order for it.
2. Point the domain to our server. A domain registered through NBT Host has our nameservers from the start; for one at another registrar, you change them yourself (see How to point your domain to NBT Host). If the website is currently with another host, we move it for free, under the conditions on the migration page, and the certificate is issued after the DNS change.
3. Enhance issues the certificate on its own, usually within a few minutes, and renews it automatically. How to check it is below, under “Steps: check the certificate”.

What an SSL certificate does

• It encrypts the connection between the visitor and the site. Passwords and the data in forms and in the cart travel encrypted, not in plain text, across the network the visitor is connected to (for example a public Wi-Fi).
• It proves that the visitor reached the right domain, not a server pretending to be it.
• It removes the browser warning. On a site without a certificate, Chrome, Edge and Safari show Not secure next to the address, and on pages with forms the warning is even more visible.
• It matters to Google: using HTTPS is one of the signals taken into account when ranking pages.

Free or paid: what is different

Let's Encrypt is a nonprofit certificate authority that issues certificates for free and automatically, so that as much of the internet as possible is encrypted. The free certificate is not a “weaker” option: the encryption is the same as with a paid one. The only difference is what the issuer checks:

For a business website, a blog or an online store, the free certificate is enough. A paid certificate makes sense only if a partner, a bank or a contract explicitly requires OV or EV. If you already have one, you install it yourself from Enhance (see “If something does not work” below).

What you'll get

• a valid certificate for the domain and for www (a single certificate for both names), plus one for mail.domeniul-tau.ro — but only for the names that point to our server;
• the same for the subdomains and aliases you add: each one gets its own certificate;
• automatic renewal: Let's Encrypt certificates are valid for 3 months, and Enhance requests a new one by itself 14 days before expiry. You have nothing to do.

Before you start

• The domain must point to our server: through the nameservers ns1.nbt-host.ro and ns2.nbt-host.ro or, if your DNS is elsewhere, through the records in How to point your domain to NBT Host.
• Enhance requests the certificate as soon as the domain is added. Until it receives it — usually a few minutes — it uses a temporary “Self signed” one, which browsers do not accept. If the domain has only just been pointed to us, give it a few hours: Enhance retries by itself, at increasingly longer intervals.
• Log in to Enhance: https://server.nbt-host.com. The names below are in English, exactly as they appear on screen. If the panel opens in another language (it follows your browser’s language), switch it to English from the account menu at the top right: “My account” » “Language”.

Steps: check the certificate

1. In Enhance, open “Websites” from the left-hand menu and click the site.
2. In the site’s top bar, click “Security” (on a narrower screen you will find it in the “Advanced” menu).
3. The “SSL certificates” card lists the site’s domains, with the columns “Status”, “Domain”, “Certificate”, “Force https” and “Expiry date”.
4. Look at “Certificate” first: “Let's Encrypt” means a valid certificate, and “Self signed” is the temporary one. “Status” only reflects the expiry date: “Active”, “Expiring soon” (expires in less than 7 days) or “Expired” — the temporary certificate also shows as “Active”.
5. Check in the browser too: open https://domeniul-tau.ro, click the padlock and look at the certificate. It must be valid and issued by Let's Encrypt.

Steps: request a new certificate

After you have fixed the cause (for example, corrected the DNS):

1. In “SSL certificates”, click “⋯” at the end of the domain’s row.
2. Choose “Request Let's Encrypt certificate” and confirm with “Request”. If the domain already has a certificate, the new one replaces it.
3. Enhance shows “Issuing a Let's Encrypt certificate for …”, then “Issued a Let's Encrypt certificate for …”. If it fails, you see “Failed to issue a Let's Encrypt certificate for …” and the reason: write it down, as it tells you what needs fixing (see “If something does not work”).
4. For the email address (mail.domeniul-tau.ro), choose “Request Let's Encrypt certificate for mail.” from the same menu.

Do not repeat the request many times in a row: after each failure, Enhance waits longer before the next attempt, and Let's Encrypt limits the number of requests.

If something doesn't work

• The domain does not point to the server. The reason mentions DNS, a foreign IP address or a failed check. Check the nameservers or the A record, wait for propagation, then request the certificate again.
• An old AAAA record is still there. If your DNS is at Cloudflare or at the registrar and an AAAA record from your previous provider is still there, Let's Encrypt tries over IPv6 and does not reach us. Delete the AAAA records for the domain and for www: our zone does not use IPv6.
• www or mail has no certificate. When your DNS is elsewhere, each name must exist there: CNAME www → your domain and A mail → 185.230.138.193. If www was missing, Enhance issued the certificate without it. After you add the records, request the certificate again (for mail, with the “for mail.” option).
• The domain is on Cloudflare, set to “Proxied”. Switch the records to DNS only (the gray cloud): through the proxy, issuing and renewing the certificate can fail. If you still want the Cloudflare proxy, talk to us first; the SSL/TLS mode in Cloudflare must be Full (strict), not Flexible — with Flexible, the site ends up in a redirect loop.
• A CAA record does not allow Let's Encrypt. If the zone has CAA records, one of them must have the value 0 issue "letsencrypt.org". Add it or delete the CAA records you do not need (see The DNS zone editor: A, CNAME, MX and TXT).
• You have a purchased certificate. Add it from the same card, with “Install custom SSL”: choose the domain and fill in “Certificate (CRT)” and “Private key”, then “Upload”. 3 days before it expires, Enhance automatically requests a Let's Encrypt certificate to replace it.

Frequently asked questions

Does the SSL certificate stay free at renewal?

Yes, as long as the domain is hosted with us: it is included in the plan, and the renewal every 3 months is automatic and costs nothing.

How long until the padlock appears?

Usually a few minutes after the domain is added. If the domain has only just been pointed to us, it can take a few hours, until DNS propagates; meanwhile Enhance keeps retrying on its own.

Do I need a paid certificate for an online store?

No. The encryption is the same as with a paid certificate. An OV or EV certificate only makes sense if a partner, a bank or a contract explicitly requires one.

Do subdomains and email get a free certificate too?

Yes. Every subdomain and alias you add gets its own certificate, and mail.domeniul-tau.ro gets one too, if it points to our server.

Does the free certificate work if the domain is registered elsewhere?

Yes. All that matters is that the domain points to our server, through nameservers or DNS records, not where it is registered.