Help Centre / Domains And Going Live
SSL Certificates On Oxyforge
A certificate is what lets a browser show your site over HTTPS, with the padlock, instead of plain HTTP. On a lot of hosts that is a product you buy, install and remember to renew. Here it is part of the platform.
There is nothing to buy, nothing to install and nothing to renew. If you came looking for where to purchase a certificate, you can stop.
Every Connected Domain Gets One
A certificate is issued for every domain you connect to a website, and for the site-xxxx.oxyforge.net platform address the website was born with. You do not ask for them and you do not choose between them.
Certificates are issued and renewed by Cloudflare, by itself and well before expiry. An expired certificate is the kind of outage that takes a site down for a weekend on hosts where a human has to remember, and it is exactly the sort of job that should not be a human’s to remember.
HTTPS Is Always On
Plain HTTP is redirected to HTTPS. There is no setting to serve a site insecurely, because there is no good reason to want one.
That means you do not need a plugin to force HTTPS, and you should not install one. WordPress plugins that rewrite protocols are a common cause of redirect loops on a platform that is already doing the job.
Timing: Why A New Domain Shows A Warning Briefly
A certificate can only be issued once DNS for the domain points here, because that is how the certificate authority proves the domain is yours. This is why a freshly added domain sits as pending on the Domains tab for a short while, and why a browser may show a warning if you rush to load it.
The sequence is always the same.
| Stage | What you see |
|---|---|
| Domain added, DNS not changed yet | Pending, and the record to add |
| DNS changed, not yet seen | Still pending, Check Again will push it |
| DNS seen | Certificate issued |
| Certificate live | Pending clears, and the domain loads over HTTPS with a padlock |
A certificate warning on a domain you connected minutes ago is almost always timing, not a fault. Wait a few minutes and try again in a private window.
Where The Encryption Happens
Cloudflare sits in front of every website here and terminates TLS at the edge, on a machine close to your visitor. That is the same layer that provides the CDN and the firewall, so the certificate, the caching and the filtering are all handled at the same place.
The practical effect is that the handshake happens near the visitor rather than in Singapore, which makes the first connection faster for people a long way away.
What A Certificate Does And Does Not Do
A certificate proves the connection between your visitor and the site is encrypted and that the name in the address bar is the one it claims to be. That is all.
It does not make a site secure. It does nothing about a weak administrator password, an abandoned plugin with a known hole, or malware already in the files. Those are different jobs. See malware scans.
It also says nothing about who you are. Browsers stopped showing company names in the address bar years ago, which is why the expensive validation tiers that certificate resellers still sell no longer buy you anything a visitor can see.
Mixed Content: The One Problem You Can Still Have
A page served over HTTPS that pulls an image, script or stylesheet over plain HTTP is mixed content. The browser either blocks it or drops the padlock, and the page can look broken even though the certificate is fine.
This is content inside WordPress, not a certificate problem, so it is yours to fix. It comes from three places.
- A migrated site whose database still holds
http://addresses. Running the search and replace when you make a domain primary deals with most of these. See make a domain your primary address. - A hard-coded URL in a page, a widget or a theme option, typed in by hand years ago.
- An external resource that is only available over HTTP, usually an old font or map embed. Replace it.
Your browser’s developer console lists every blocked resource with its address, which tells you exactly which page and which file to fix.
Troubleshooting
| What you see | What it usually means |
|---|---|
| Certificate warning on a new domain | DNS has only just started pointing here. Wait and retry. |
| Warning on a domain that worked yesterday | The name in the address bar is not one you connected, often www when only the root is connected |
| Too many redirects | A WordPress plugin forcing HTTPS on top of the platform. Remove it. |
| Padlock missing, page otherwise fine | Mixed content, not the certificate |
Site loads on www but not the root, or the other way round | Only one of the two is connected. Connect both. |
Check the name, not the site. A warning that names a different domain than the one you typed means a DNS record is pointing somewhere unexpected. See DNS records explained.
Check in a private window. Browsers cache certificates, redirects and HSTS policies, and a stale one in your own browser outlives the fix.
If a domain is past pending, DNS looks right, and the warning persists in a private window, open a ticket from the members area with the domain name. Certificate issuance is something we can see from our side.
Did this answer it? If not, open a ticket from the members area and someone who runs the platform will pick it up.
Open A Ticket