SSL Certificate Best Practices: Keep Your Site Secure and Trusted

A valid SSL certificate is non-negotiable for any website. It encrypts traffic, protects your users, and is required for modern browsers to show the padlock icon. But SSL management involves more DNS configuration than most people realize — and getting it wrong leads to browser warnings, failed renewals, and security gaps.

Not all SSL certificates are the same. Choosing the right type saves money and avoids coverage gaps.

Single-domain certificates cover one specific domain (e.g., example.com). They don't cover www.example.com unless explicitly included. Most free certificates from Let's Encrypt are single-domain by default.

Wildcard certificates cover a domain and all its direct subdomains: *.example.com covers www, mail, app, api, and any other subdomain — but not the apex domain itself (example.com). You typically need both example.com and *.example.com in the same certificate.

Multi-domain (SAN) certificates cover multiple specific domains in a single certificate. Useful when you manage several related domains.

Extended Validation (EV) certificates require identity verification of the organization. They no longer show the green bar in modern browsers, so the extra cost is rarely justified for most sites.

CAA (Certification Authority Authorization) records are a DNS-based security control that restricts which certificate authorities can issue certificates for your domain. They're one of the most underused security features in DNS.

Why they matter: Without CAA records, any of the hundreds of trusted CAs can issue a certificate for your domain. A compromised or misbehaving CA could issue a fraudulent certificate. CAA records prevent this.

Setting up CAA records:

For Let's Encrypt:

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issuewild "letsencrypt.org"

For multiple CAs (e.g., Let's Encrypt and DigiCert):

example.com.  CAA  0 issue "letsencrypt.org"
example.com.  CAA  0 issue "digicert.com"

For violation reporting:

example.com.  CAA  0 iodef "mailto:[email protected]"

Important: If you add CAA records, make sure every CA you use is listed. A missing CA entry will cause certificate issuance to fail — even for renewals.

Let's Encrypt certificates expire every 90 days. Auto-renewal is convenient but fragile if your DNS isn't configured correctly.

CAA record blocking renewal — If you added CAA records after your initial certificate was issued, make sure Let's Encrypt (letsencrypt.org) is listed. Check your CAA records before every renewal window.

A record pointing to wrong server — Let's Encrypt's HTTP-01 challenge requires the domain to resolve to the server requesting the certificate. If your A record points elsewhere, the challenge fails. Always verify your A record before requesting or renewing.

DNS propagation not complete — If you recently changed your A record or nameservers, wait for full propagation before attempting certificate issuance. The CA's validation servers may still see old records.

Rate limits — Let's Encrypt limits you to 5 duplicate certificates per week. If renewals are failing repeatedly, you may hit this limit. Use their staging environment for testing.

Wildcard certificates (*.example.com) require DNS-01 validation instead of HTTP-01. This means you must add a TXT record to your DNS to prove domain ownership.

The DNS-01 challenge process:

1. Your ACME client requests a wildcard certificate
2. Let's Encrypt gives you a token to add as a TXT record at _acme-challenge.example.com
3. You add the TXT record to your DNS
4. Let's Encrypt verifies the record
5. Certificate is issued

For automated wildcard renewals, your ACME client needs API access to your DNS provider to add and remove the challenge record automatically. Most major DNS providers (Cloudflare, Route 53, etc.) have ACME plugins for this.

Use DomainSpy's SSL Checker to inspect any domain's certificate:

• Expiry date — how many days until renewal is needed
• Grade — A (excellent), B (good), C (weak), or Expired
• Subject Alternative Names (SANs) — which domains the certificate covers
• Issuer — which CA issued the certificate
• Protocol support — TLS 1.2 and 1.3 should be enabled; TLS 1.0 and 1.1 should be disabled

Check your certificate at least monthly, and set up monitoring alerts for certificates expiring within 30 days.

Having a valid certificate isn't enough — you need to ensure all HTTP traffic redirects to HTTPS. This is a web server configuration, not a DNS setting, but it's part of a complete SSL setup.

A proper redirect:

• Returns a 301 (permanent) redirect from http:// to https://
• Applies to both the apex domain and www
• Includes HSTS headers to tell browsers to always use HTTPS

• Choose the right certificate type: single-domain, wildcard, or multi-domain
• Add CAA records to restrict which CAs can issue certificates for your domain
• Verify your A record is correct before requesting or renewing certificates
• Wildcard certificates require DNS-01 validation — plan for automated DNS API access
• Check certificate health regularly and monitor expiry dates
• Ensure HTTP-to-HTTPS redirects are in place after certificate installation

SSL management is mostly a set-it-and-forget-it task once configured correctly. The key is getting the DNS side right from the start — CAA records, correct A records, and proper propagation timing.