# Hostinger SSL: Lifetime SSL, failed installs, CAA, Force HTTPS > How Hostinger's free Lifetime SSL installs, what to do about CAA records, how to fix Failed or Installing status, force HTTPS and import an SSL. Source: https://ssl.sh/guides/hostinger-ssl/ Last updated: 2026-11-10 Hostinger installs a free Lifetime SSL certificate automatically on every Web and Cloud hosting plan once a domain is added and points to Hostinger, normally within 1–2 hours. HTTPS is forced by default. If the SSL page in hPanel shows Failed or stays on Installing, the cause is almost always DNS that does not reach Hostinger, a Cloudflare proxy, CAA records or an over-long domain name. Steps follow the Hostinger Help Center as of November 2026. ## How Hostinger issues certificates Lifetime SSL is automatic on shared plans. Hostinger states that it provides free SSL certificates on all Web and Cloud hosting plans and that "Lifetime SSL installs automatically once a domain is added to your hosting plan." Its troubleshooting article gives the expected time: Lifetime SSL installs automatically within 1–2 hours after you add a website, subdomain or parked domain, and failed attempts are retried automatically. Websites built with Hostinger's AI website builder get SSL after publishing, and SSL settings are not editable there. Wildcard certificates are only supported on VPS plans. The help center does not name the certificate authority behind Lifetime SSL. Check the issuer of your live certificate with the [SSL checker](https://ssl.sh/tools/ssl-checker/); you need that name if you publish CAA records. ## Point your domain to Hostinger The domain must resolve to your Hostinger hosting before the certificate can install. hPanel offers two ways: - **Nameservers:** set the nameservers shown in hPanel at your registrar. Hostinger's examples look like `example1.dns-parking.com` and `example2.dns-parking.com`, but its docs warn that "Hostinger nameserver pairs differ per domain, so never guess one or copy it from another guide or domain." - **A records:** choose **Connect via DNS record** and create A records for `@` and `www` pointing to the hosting IP shown in hPanel, keeping your current DNS host. Hostinger allows up to 24 hours for propagation. Keep only one A record for the domain: an old A record pointing elsewhere means validation may hit the wrong server. ## CAA records Hostinger's position is that Lifetime SSL does not need [CAA](https://ssl.sh/glossary/caa/) records. The failed-install article says "Lifetime SSL does not require Certificate Authority Authorization (CAA) records", and its fix is to delete CAA records from the DNS zone. Hostinger's separate CAA article tells you to keep the default CAA records Hostinger creates, and for a custom SSL says "Both the tag and the CA domain should be provided by your certificate issuer." So: - No CAA records of your own: leave it that way. - CAA records you added for another service and Lifetime SSL fails: delete them, as Hostinger instructs, or add a record for the CA that issued your Hostinger certificate. - Custom SSL: add the CA domain your issuer documents, for example `0 issue "ssl.com"` for SSL.com. Check what is published with the [CAA checker](https://ssl.sh/tools/caa-checker/); [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/) explains how a CA evaluates the records. ## When SSL shows Installing or Failed Installing for up to two hours is normal; after that, work through Hostinger's checklist. The status is under **Websites → Manage → Security → SSL**, where Hostinger uses four values: **Active**, **Installing**, **Inactive** and **Failed**. The checklist: 1. **DNS:** the domain must point to Hostinger by nameservers or A record, and propagation must be complete. 2. **Cloudflare:** "temporarily set the A record to DNS only (bypass proxy) until the SSL installation completes", then re-enable the proxy once the certificate is Active. 3. **One A record:** remove extra A records for the same name. 4. **CAA:** delete CAA records, as described above. 5. **Domain length:** "The total length of the domain (including subdomains and extensions like .com) must be 64 characters or fewer." Longer names cannot get a certificate. 6. **Reinstall:** on the SSL page, open the ⋮ menu next to the domain, choose **Uninstall**, then install the SSL again. Check DNS from outside before reinstalling: ```bash dig +short NS example.com dig +short A example.com dig +short A www.example.com dig +short CAA example.com ``` Two related errors have their own Hostinger articles. `ERR_SSL_PROTOCOL_ERROR` right after installation is fixed by uninstalling and reinstalling the SSL; see [ERR_SSL_PROTOCOL_ERROR](https://ssl.sh/errors/err-ssl-protocol-error/). `ERR_TOO_MANY_REDIRECTS` means two redirects fight each other: an `.htaccess` rule on top of Force HTTPS, a Cloudflare SSL mode that talks HTTP to the origin, or WordPress `siteurl` and `home` values that do not start with `https`. ## Force HTTPS On Web and Cloud plans HTTPS is already forced. Hostinger states: "As soon as an SSL certificate is installed on your website on any Web or Cloud hosting plan, HTTPS will be enabled (forced) by default." To change it, open **Websites → Manage → SSL**, click ⋮ next to the domain and choose **Unforce HTTPS**; choose **Force HTTPS** to turn it back on. "Forcing and unforcing HTTPS is not available on Agency Hosting plans." Do not add a second HTTPS redirect in `.htaccess` while Force HTTPS is on; that is a common cause of redirect loops. Hostinger's help center does not offer an HSTS switch; to add the header yourself, see [enable HSTS](https://ssl.sh/guides/enable-hsts/). ## Fix mixed content Hostinger's mixed content guidance has two routes. The proper fix is to replace `http://` with `https://` in the site's configuration and content (for WordPress, the site URLs and stored links). The quick fix is a header in `.htaccess` that tells browsers to upgrade insecure requests: ```apache Header always set Content-Security-Policy: upgrade-insecure-requests ``` Hostinger notes this header approach is not recommended if your site uses symlinks. The header only helps when the HTTPS version of each resource exists. Find the insecure URLs with the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) and see [mixed content warning](https://ssl.sh/errors/mixed-content-warning/). ## Can you upload your own certificate? Yes. Open **Websites → Manage → Security → SSL**, choose **Import SSL**, and paste the certificate, private key and CA bundle (CABUNDLE). The domain must not have an SSL installed at the time, so uninstall Lifetime SSL first. Custom SSL is not available for sites built with Hostinger's AI website builder, and Hostinger supports custom wildcard and multi-domain certificates only on VPS. Hostinger warns that an expired custom certificate combined with forced HTTPS makes the site inaccessible. With public certificates limited to 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, a custom certificate needs a reinstall several times a year, while Lifetime SSL renews itself. Always include the CA bundle; see [install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/). ## Verify Once the status is Active, the site should present a valid certificate and redirect HTTP to HTTPS. Test from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the issuer, covered names, chain and expiry. Lifetime SSL renews automatically while DNS keeps pointing at Hostinger; add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) if you want an alert when that stops.