Summary

This guide helps you troubleshoot and resolve: How does ssl and https work for my website. Follow the steps below to fix the issue.

Common Causes

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are the technologies that encrypt data sent between a visitor’s browser and your web server. When a certificate is correctly installed, your site loads over https:// instead of http://, and browsers display a padlock icon in the address bar. This encryption protects sensitive information such as contact form enquiries, login credentials, and payment details from being intercepted while in transit.

Why HTTPS matters for your business

Using HTTPS is now the standard expectation for Australian websites. Browsers mark plain HTTP sites as “Not secure,” which can discourage customers from completing forms or making purchases. Search engines also use HTTPS as a ranking signal, so unencrypted sites may appear lower in search results. Beyond encryption, a valid certificate helps confirm that visitors are connecting to your genuine website and not an impostor.

How the HTTPS connection works

When a visitor types your domain into their browser, the following happens:

1. The browser requests a secure connection to your web server.
2. The server presents its SSL/TLS certificate, which contains your public key and identity details.
3. The browser checks that the certificate is valid, issued by a trusted certificate authority, and matches your domain name.
4. If the checks pass, the browser and server establish an encrypted session using a temporary session key.
5. All data exchanged between the visitor and your server is now encrypted for the remainder of the visit.

Common SSL and HTTPS issues

Expired certificate

SSL/TLS certificates have a validity period, commonly one year. Once a certificate expires, browsers display a full-page security warning before allowing the visitor to proceed. This warning damages customer trust and can cause an immediate drop in traffic and enquiries.

Mixed-content warnings

A mixed-content error occurs when a page loads over HTTPS, but some elements on the page—such as images, stylesheets, or scripts—are still loaded over HTTP. Modern browsers block these insecure resources or display a warning that the connection is not fully secure. The padlock icon may disappear or change to a warning triangle.

Missing HTTPS redirect

Installing a certificate does not automatically force visitors to use HTTPS. If your site is accessible via both http:// and https://, search engines may index duplicate versions of your content, and visitors may still arrive at the unencrypted version. A server-side redirect sends all HTTP traffic to HTTPS automatically.

Quick fix steps

1. Check your certificate expiry date in your hosting control panel or SSL provider dashboard.
2. Renew the certificate if it has expired or is due to expire within the next 30 days.
3. Install the renewed certificate on your web server, or reissue it through your certificate authority.
4. Enable a permanent 301 redirect from HTTP to HTTPS in your hosting control panel or website configuration.
5. Update internal links and resource URLs from http:// to https:// to resolve mixed-content warnings.
6. Test your site in multiple browsers and confirm the padlock icon appears on every page.

Detailed instructions

Checking your certificate status

1. Open your website in Google Chrome, Microsoft Edge, or Safari.
2. Click the padlock icon in the address bar to view the connection security details.
3. Select the option to view the certificate or connection information.
4. Check the “Valid to” or expiry date to confirm the certificate is current.

Renewing an SSL certificate

1. Log in to your domain registrar or SSL certificate provider’s control panel.
2. Locate the SSL/TLS certificates section for your domain.
3. Select the certificate approaching expiry and choose the renew or reissue option.
4. Complete any domain validation steps required by the certificate authority.
5. Download the issued certificate files, typically including the certificate file (.crt), private key (.key), and any intermediate or CA bundle files.

Installing the certificate

1. Log in to your web hosting control panel (for example cPanel, Plesk, or your host’s custom dashboard).
2. Open the SSL/TLS manager or security section.
3. Choose the option to install or upload an SSL certificate.
4. Paste or upload the certificate, private key, and CA bundle files provided by your certificate authority.
5. Assign the certificate to the correct domain and save the changes.

If you are unsure which files to upload, contact your certificate authority or hosting provider for assistance. Incorrectly pasting the private key can break the secure connection.

Forcing HTTPS with a redirect

1. Log in to your hosting control panel.
2. Open the redirects, domains, or SSL/TLS settings section.
3. Enable the option to force HTTPS or redirect HTTP to HTTPS.
4. Alternatively, add a redirect rule to your website’s .htaccess file if you are running Apache:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

5. Save the file and test your site by visiting http://yourdomain.com.au. It should automatically load as https://yourdomain.com.au.

Fixing mixed-content errors

1. Open your website in Google Chrome.
2. Press F12 to open Developer Tools, then select the Console tab.
3. Look for messages marked “Mixed Content” that list insecure HTTP URLs being loaded on an HTTPS page.
4. Edit your website’s theme, content, or database to replace those URLs with HTTPS equivalents.
5. If you use a content management system such as WordPress, update the WordPress Address and Site Address under Settings > General to use https://.
6. Clear any caching plugins or server caches, then reload the page and confirm the padlock icon returns.

Troubleshooting

Certificate not trusted by browsers

This usually means the certificate was issued by an authority not trusted by the browser, or the intermediate certificate was not installed correctly. Reissue the certificate through a trusted certificate authority and ensure the full certificate chain is installed on your server.

Site still loads over HTTP after redirect

Clear your browser cache or test in an incognito window. Caching plugins and CDN services may also cache the old HTTP version of your site. Purge all caches after enabling the HTTPS redirect.

Padlock missing on some pages

This indicates mixed content on those specific pages. Use the browser developer console to identify the insecure resources and update them to HTTPS.

Certificate expiry warning returning

If you renewed the certificate but the warning persists, the server may still be presenting the old certificate. Restart your web server after installation, or contact your hosting provider to confirm the new certificate is active.

Do not share your private key (.key) with anyone. If you suspect the private key has been compromised, revoke the certificate and issue a new one immediately.

SSL certificates are not a set-and-forget solution. Set a reminder to renew your certificate before it expires, or enable auto-renewal through your certificate authority or hosting control panel where available.

If you host with us, you don’t need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?