The safest small-business setup uses automated certificate issuance and renewal through the host, platform or an ACME client. Installation is complete only after every required hostname works, HTTP redirects safely and renewal has been tested.
Before you make a change
A broken HTTPS change can block the entire site. Test required hostnames before enabling permanent redirects or HSTS.
Prepare
- List the canonical domain, www variant and required subdomains.
- Confirm each hostname resolves to the intended service.
- Back up web-server and proxy configuration.
- Identify who controls DNS if DNS validation will be used.
- Check whether the platform already manages certificates automatically.
Issue and install
- Request a certificate covering the required hostnames.
- Complete HTTP or DNS validation using the provider’s current method.
- Install the certificate and full chain on every service that terminates HTTPS.
- Test each hostname directly before enforcing redirects.
- Update application URLs, internal links, canonicals and sitemaps to HTTPS.
- Redirect HTTP to the matching HTTPS URL.
- Schedule renewal and failure notifications.
Test the live result
| Check | Pass condition |
|---|---|
| Hostname coverage | Every public hostname is included and trusted |
| Redirects | HTTP reaches the same HTTPS page without loops |
| Mixed content | No important HTTP resources remain |
| Forms and login | Submit and authenticate successfully |
| Renewal | Automatic renewal is enabled and a test or provider evidence exists |
| Monitoring | Expiry and availability are checked externally |
Do not force HTTPS too early
If redirects are enabled before the certificate or application is ready, visitors can be locked into errors. Prove HTTPS first, then redirect. Keep a rollback for proxy and application settings.
Protect the private key
Limit access, avoid sending keys through ordinary email and revoke certificates if a key may have been exposed. A replacement certificate alone does not invalidate the compromised one.
Test renewal, not only issuance
A newly issued certificate proves that validation worked once. It does not prove that renewal will succeed after DNS, firewall or platform changes. Use the host’s test function or the ACME client’s documented dry-run method where available, and monitor the public expiry date independently.
Record whether validation depends on port 80, a DNS API token, a CDN integration or a provider account. A future administrator needs this dependency to diagnose renewal failures safely.
Final publication check
- HTTPS works before redirects are enforced.
- Every required hostname is covered.
- Mixed content and forms have been tested.
- A renewal test and external expiry alert exist.
Sources and date checked
Technical and policy information was checked on 21 July 2026. Recheck provider-specific procedures before making a live change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.