Securing a Website with SSL

SSL/TLS certificates enable visitors to connect to your site with HTTPS, a secure protocol for exchanging information on the Internet. SSL certificates add a layer of secure encryption to your website, so any information transferred by your website is encrypted. In this article we will explain how to obtain SSL certificates for your website on the WP Engine platform.

Watch this brief video to learn how to add a third-party SSL certificate:

---

About HTTPS, TLS and SSL

HTTPS (Hypertext Transfer Protocol Secure) is the protocol for secure communication on the World Wide Web, and it prevents eavesdroppers from seeing information that visitors send or receive over the Internet. HTTPS secures its connections by using SSL/TLS, protocols that authenticate web servers and that encrypt messages sent between browsers and web servers.

TLS (Transport Layer Security) is a cryptographic protocol that provides secure communication over the Internet. HTTPS uses TLS to secure communication for website visitors. TLS provides the following security benefits:

• Identity authentication — The browser determines whether a web server is the right server, and not an imposter.
• Privacy — Information between the browser and web server is kept private by using encryption.
• Data integrity —  Messages between the browser and the web server cannot be altered by others (e.g., during a man-in-the-middle attack).

SSL (Secure Sockets Layer) is the predecessor of TLS. After SSL 3.0, the next upgrade was named TLS 1.0 (instead of SSL 4.0) because the version upgrade was not interoperable with SSL 3.0. Many people refer to TLS as SSL (old habits die hard) or as SSL/TLS, even though all versions of SSL are technically now deprecated.

Review our guide for more information on which TLS versions are currently supported.

Check SSL Status

To determine if you have any SSL certificate installed on your website, visit your domain with https:// in front. The “s” in HTTPS stands for “secure”. For example: https://mycoolwebsite.com

• If you see a secure padlock next to the domain this means your site is secured by the SSL certificate. You can also click on this icon to view certificate details, such as expiration date and issuer.

• If you see a security warning, this means your site is not secured by SSL and you will need to add one.

• If the padlock next to your domain is broken, crossed out, or shows “more info”, this means your site is secured by SSL but there is mixed content on the page that needs correcting.

You can also test your SSL status with an external tool:

• Qualys SSL Labs – Server Test
• SSL Shopper – SSL Checker

View in User Portal

To check if there is SSL installed on WP Engine, visit the SSL page in the User Portal:

1. From the sites page Sites page, click the environment name
2. Select “SSL”

Any SSL on this environment will display in the list, including issuer name and expiration date. Let’s Encrypt certificates will display the option to toggle “Auto renew” on or off, which allows or disallows the SSL to order again automatically prior to expiration. Auto renew defaults to “on” for Let’s Encrypt certificates.

---

Add SSL

When pointed to the Advanced Network or Global Edge Security, SSL is applied and URLs are forced to HTTPS automatically. If desired, additional SSL can be applied using the following steps.

Before ordering SSL, you’ll need to ensure that the domain(s) have been added to the User Portal. When using Let’s Encrypt, DNS should also be pointed to WP Engine.

To add SSL to a website:

1. From the Sites page, select the environment name
2. Click SSL
3. Click Add Certificates
4. Select an from the SSL Certificate Options:
   • Get Free Let’s Encrypt SSL Certificates
   • Import A New or Existing 3rd-party SSL Certificate
5. Follow the prompts to complete the request process
6. When the SSL has completed installation, you will receive an email and the SSL options will become available

The process is automated from here. Our system will verify DNS has been pointed and install the certificate. SSL certificates typically install and activate within a few minutes, however in some cases can take up to 24 hours.

• All SSLs ordered through WP Engine default to Auto-Renew and Secure All URLs- this includes Let’s Encrypt, Advanced Network, and Global Edge Security SSL certificates.
• Third party certificates cannot auto-renew, as WP Engine is not the issuer we will not automatically have access to the updated SSL files. Third-party SSL certificates should be added as a new third-party SSL when renewal occurs.
  

---

Let’s Encrypt SSL Certificates

Let’s Encrypt offers free domain-validated (DV) single-domain SSL certificates, which are ideal for almost every website. In most cases two Let’s Encrypt certificates need to be ordered for a single site; one for WWW and one for non-WWW.

If you should, but do not see the WWW or non-WWW version of your domain listed here, be sure both variations are added to the User Portal.

Let’s Encrypt certificates expire after 90 days. Our system will attempt to auto-renew these 22 days before expiration.

Ordering a Let’s Encrypt certificate replaces any existing certificates on WP Engine for that domain (EX: 3rd-party certificate).

---

Import 3rd-Party SSL Certificate

WP Engine only provides free single-domain certificates at this time. Therefore the purchase and import of a 3rd-party SSL, purchased externally, may be necessary in a several situations:

• If you already have a valid SSL certificate you want to use
• If you need to use a wildcard SSL certificate
• If you need to use an Extended Validation (EV)
• If you need to use a Multi-Domain certificate (SAN)

Using a 3rd-party SSL also allows you to secure the domain prior to DNS being pointed to WP Engine. The SSL will not be active until you point DNS to your WP Engine server and add the domain in the User Portal.

To import any 3rd-party SSL successfully, a matching certificate and key file are required. In some cases, there may also be additional intermediate certificates that you must provide.

Currently the same 3rd party certificate cannot be used in more than one install when using the Advanced Network or the Global Edge Security Network (GES). If a 3rd party certificate is needed for multiple installs, certificates should be created for each install.

There are a few other stipulations to be aware of:

• Third party SSLs can be added to the Legacy Network, Advanced Network, or Global Edge Security.
• Lite and Startup plans cannot have a third party SSL certificates imported.
• On Shared WP Engine plans, only Production environments can have SSL installed.

Import Using Existing Certificate Files

If you already have both the SSL certificate and the matching private key file, use these steps. If you’re not sure if you have both matching files, proceed instead with the Generate a New Certificate Signing Request (CSR) steps below.

1. From the Sites page, select the environment name you wish to upload SSL files for
2. Click SSL
3. Select Add Certificates
4. Under Import using existing certificate files, select Upload Files

5. Either copy and paste the contents of your existing certificate files into the fields, or select Upload the {key or certificate} file
   • RSA private key (KEY)
     • Paste in the full key including -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY----- and -----END RSA PRIVATE KEY-----
     • If you choose to upload a file instead, key files must be RSA type keys with a .key file type.
   • Certificate (CRT)
     • Only PEM formatted certificates will be accepted in this field. Paste in the full PEM chain including -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
     • If you choose to upload a file instead, certificate files must be PEM formatted with .pem, .crt, or .cer file types.

8. Click Next
9. Verify the certificate information is valid
   • The correct domain(s) should be listed and selected
   • The certificate validity date should be current, and not expired
10. Click Next
11. Choose HTTPS Preferences
    • Secure All URLs (default) will force all URLs to HTTPS once the SSL has been successfully installed. For more information see Secure URL Options below.
12. Click Upload Certificate

Your certificate and key file will then be reviewed, and if they match they will be installed and activated. If your files do not match, you will receive a notice and the SSL will not be installed or activated.

---

Generate New Certificate Signing Request (CSR)

This section will help you generate a CSR (Certificate Signing Request) and import your matching certificate file to WP Engine. Generate a CSR and follow these steps if you don’t have a certificate file, don’t have a key file or if you do not have a matching certificate and key file.

Remember, WP Engine needs both a key file and a certificate file that match each other to successfully install the SSL. Generating a CSR will complete the key portion of these requirements for you, so all you have to do is retrieve the matching certificate from the SSL issuer and provide it to us.

1. From the Sites page, select the environment name you wish to generate a CSR for
2. Click SSL
3. Select Add Certificates
4. Under Generate a new certificate signing request (CSR), select Create CSR

5. Select the Certificate Type
   • This should match the type of existing SSL that you will be importing
6. Select the domain(s) the certificate was issued for when it was originally purchased
7. Fill in the necessary Business Information
8. Click Generate CSR

9. The next page will show your CSR file contents
10. Confirm the information on the right side of the page is correct
11. Use Click to copy or Download as .CSR to ensure you copy the full contents of your CSR correctly. The full CSR will include the following text at the top and bottom:
    • -----BEGIN CERTIFICATE REQUEST-----
    • -----END CERTIFICATE REQUEST-----

We suggest leaving this page open in a separate tab or window so you can easily return to it later.

Request Certificate from Issuer

Once you have the CSR, you must provide it to your 3rd-party SSL certificate authority. The SSL certificate authority, or issuer, is the company from which you originally purchased the SSL certificate.

1. Log in to your SSL issuer’s portal, or reach out to their Support team
2. Request your SSL files for installation on another server, you may need to request that the SSL be re-keyed
3. Provide the CSR file generated in the previous step to the issuer
4. If the issuer asks for server type, choose Nginx
5. Ensure the certificate is PEM formatted in the .pem, .crt, or .cer file type
6. Your SSL certificate issuer will return a newly generated SSL certificate file(s)
   • There may be multiple files, be sure to save everything the issuer provides
7. Copy or save any files provided to your local computer in a location where you can easily find them in the next step
   • The full certificate contents will include the following text at the top and bottom:
     • -----BEGIN CERTIFICATE-----
     • -----END CERTIFICATE-----

Upload Certificate to WP Engine

When you are ready to upload your certificate, return to the WP Engine User Portal.

• If you left the CSR page open previously, simply click Upload Certificate on the right.

• If you navigated away from the CSR page, the request can be managed again any time from the SSL page in your User Portal. Click the arrow next to a pending request to expand the options to Upload Certificate (CRT), View certificate signing request (CSR), or Delete and Revoke CSR. To upload a certificate, simply click Upload Certificate (CRT).

1. Paste or upload any certificate files provided by the SSL issuer
2. Click Next
   • The file will automatically be compared to the CSR for a match. You will be taken to the next page if the files match.
   • If the CSR and the CRT do not match, you will see the message: This certificate did not match the CSR. You will need to copy the CSR again and repeat the steps to retrieve any certificate files from your SSL issuer.
3. Verify the certificate information is valid
   • The correct domain(s) should be listed and selected
   • The certificate validity date should be current, and not expired
4. Click Next
5. Choose HTTPS Preferences
   • Secure All URLs (default) will force all URLs to HTTPS once the SSL has been successfully installed. For more information see Secure URL Options below.
6. Click Upload Certificate

---

Potential SSL Issues

When requesting, installing or activating SSL, it is possible to run into issues. If you experience issues with your SSL, WP Engine Support is available 24x7x365 to assist and we’ve provided some additional troubleshooting information below.

Let’s Encrypt SSL Not Issuing

If the Let’s Encrypt SSL status is “pending” this may resolve itself automatically within a few minutes, however if it does not, please check the items below. If your SSL request fails to process, a Support ticket will be generated titled “Certificate Domain Validation Error” or “Certificate Authority Error.”

• Is DNS pointed to WP Engine and fully propagated? Learn how to point DNS here.
  • Check A record status here.
  • Check CNAME record status here.
• Remove any AAAA (IPv6) records on the top-level domain. (Except when using Cloudflare.)
  • Check AAAA record status here.
• Remove any conflicting CAA (certificate authority authorization) records. These limit which providers can issue SSL for the domain.
  • Check CAA record status here.
• Let’s Encrypt does not issue certificates for high-risk domain names—those that resemble well-known banks or brands (EX: wellsfargo.world or cocacola.info) or for sites that Google tags as unsafe.
• Ensure the domain is not being redirected to another domain.
• If the domain has a firewall in place, grant an exception for Let’s Encrypt or disable the firewall. (Bear in mind, Let’s Encrypt certificates are issued for 90 days periods. Adding an exception is preferred so the issue does not occur again at the next renewal.)
• Use Let’s Encrypt debug tool for more information here: https://letsdebug.net/

Corrected some of these issues and need to restart a pending SSL order? Reach out to our Support team.

Third-Party SSL Upload Failure

If a third-party SSL status is pending, the certificate files still need to be uploaded. Refer to the installation process here for more information.

If a third-party SSL failed to upload, this is either because the certificate and key files do not match or the files are in the wrong format. If the key and the crt do not match, the third-party SSL upload will continue to fail.

To troubleshoot a third-party upload error, try the following:

• Ensure the domain(s) on the SSL certificate match the exact domain(s) added to the Domains page of the User Portal.
• Generate a new CSR. Even if you already have a certificate and key file- if these are not uploading, our system does not detect a match. Using a CSR will store the matching key on WP Engine. Be sure this new CSR file is provided to your SSL issuer and that it is used to generate a matching certificate file. Be sure to upload this new matching certificate file back to WP Engine.
• Copy or upload the file contents exactly as provided by the SSL issuer. The contents should begin with a hyphenated line, like -----BEGIN CERTIFICATE-----, and end with a hyphenated line, like -----END CERTIFICATE-----
• Only certificate files that are PEM formatted with .pem, .crt, or .cer file types can be used.
• Only key files that are RSA formatted with the .key file type can be used.
• If requested, the SSL certificate should be issued for the Nginx server type.
• Invalid CSR – If this error occurs, the SSL import should be started again by generating a new CSR. See the CSR steps here.

If you have your certificate and key files but would like assistance installing them, please upload the files into the _wpeprivate directory using SFTP or SSH Gateway, then reach out to our Support team.

Cloudflare

If you are using Cloudflare, you will also need to configure SSL settings in their dashboard. Read more here about configuring SSL when using Cloudflare.

SSL/TLS certificate warnings for Internet Explorer on Windows XP

WP Engine uses Server Name Indication (SNI) for SSL/TLS certificates. SNI provides an efficient way to configure certificates, and it works well with most browsers. However, visitors that use Internet Explorer on Windows XP may see the following error. It’s best to use an alternate up-to-date browser.

Sucuri WAF

Sucuri’s firewall service may prevent your SSL from processing, due to an additional DNS layer. Please contact the Sucuri team directly to request enabling the Forward Certificate Validation to Hosting option. This will allow your Let’s Encrypt certificate request to process normally.

Mixed Content

Mixed content is media or other links on pages within your website that are not properly secured by SSL. These links use http instead of https when loaded onto the page and will cause an insecure warning on some parts of a website. Mixed content is typically simple to correct, see our correcting mixed content guide for more information.

Copy or Restore SSL

SSL files are not stored in site backups. This means SSL is not impacted by copy or restore processes.

• SSL is not included when copying a site. On the destination environment, the SSL should be reordered (Let’s Encrypt) or added as a new certificate (third party SSLs).
• Restoring the site to an earlier version will not alter the SSL.

NOTE: SSL is included when migrating a site to another server.

Remove SSL

At this time WP Engine customers cannot remove SSL certificates on their own. Please reach out to WP Engine Support for assistance deleting the SSL certificate.

---

Secure URL Options

When using Let’s Encrypt or third-party SSL, SSL may also need to be forced. To see the force SSL options, navigate to the SSL page, then click on the certificate to expand the options. The option “Secure all URLs” is selected by default.

The “Secure all URLs” option forces all pages to automatically serve requests secured with SSL over HTTPS. When using this option do not use any additional force SSL/HTTPS plugins.

The “Secure Specific URLs” option uses RegEx to ensure only the defined URLs are forced to use SSL and HTTPS.

Force SSL Plugins

Force SSL plugins can cause redirect loops when their settings conflict with the settings on the SSL dashboard. We recommend that you leverage the settings that we provide in the SSL dashboard as they work server side and have been tested extensively with our platform. Using settings directly at a server level keep the force SSL functionality on Nginx, making it faster and more effective.

How do I know if I use a force SSL plugin?

It’s possible for plugins not specifically dealing with security to to include such a setting. For example, WooCommerce offers an option to force the use of SSL. In general, to find plugins that could be forcing https usage on your website:

1. Log into your site’s WordPress Admin
2. Visit the Plugin page
3. Look for any plugin that mentions Securing Pages, HTTPS, or SSL

Common Force SSL Plugins

• Force SSL
• WP Force SSL
• WordPress HTTPS
• Verve SSL
• Really Simple SSL
• Easy HTTPS Redirection

---

NEXT STEP: How to fix mixed content errors