# Namecheap hosting SSL: free certificate, SSL.com CAA and fixes > Free SSL on Namecheap shared hosting: nameservers, CAA for SSL.com and Sectigo, fixing In progress in the Namecheap SSL plugin, HTTPS redirects. Source: https://ssl.sh/guides/namecheap-hosting-ssl/ Last updated: 2026-11-10 Namecheap shared hosting issues and installs a free SSL certificate for each domain and subdomain once the domain points to Namecheap's hosting nameservers. The free certificate covers the first year; after that you buy the renewal. Since July 11, 2026 SSL.com issues these certificates, which matters if you use CAA records. A certificate stuck at "In progress" almost always means the domain is not pointed to the hosting server. Steps and screen names follow the Namecheap Knowledgebase and status page as of November 10, 2026. ## How Namecheap issues certificates on shared hosting The free certificate is part of the hosting offer. Namecheap's Knowledgebase says eligible shared hosting customers "receive 1 free SSL certificate for 1 year" for each domain or subdomain, up to 50 domains or subdomains per cPanel account, and that certificates are "automatically issued and installed whenever a domain or subdomain is added". Test certificates and certificates for domains you later removed still count toward the 50. After the first year Namecheap says to purchase the renewal SSL through the shopping cart. Namecheap changed CA in 2026. Its provider-change article says that starting July 11, 2026, SSL certificates activated through your account are issued by "a new Certificate Authority—SSL.com". Existing Sectigo certificates keep working, and reissuing one does not change its CA. Namecheap's product list now shows SSL.com products such as Standard SSL (the old PositiveSSL), Standard Wildcard SSL, High Assurance SSL and EV SSL. When the free year ends, you can renew from your Namecheap account or buy a [Namecheap SSL certificate](https://ssl.sh/go/namecheap/); for a single site, a domain-validated Standard SSL covers the same names as the free one. AutoSSL, which many cPanel hosts use, is a different thing here: Namecheap's AutoSSL article describes it as a WHM feature on its VPS and dedicated plans, not shared hosting. ## Point your domain to Namecheap hosting The free certificate requires the domain to be "properly pointed to our Namecheap hosting nameservers". For a domain registered at Namecheap, choose **Namecheap Web Hosting DNS** in the domain's nameserver settings, which sets: ```text dns1.namecheaphosting.com dns2.namecheaphosting.com ``` If the domain stays on other nameservers (Cloudflare or your registrar's DNS), Namecheap's plugin article says both the domain and `www` must point to the hosting server with A or CNAME records; the server IP is in your hosting welcome email. Allow up to 24–48 hours for nameserver changes. ## CAA records: ssl.com, and Sectigo for older certificates If your domain has [CAA](https://ssl.sh/glossary/caa/) records, they must allow the CA that issues your certificate. Namecheap's CAA article says to "Specify "ssl.com" in Value field for all SSL.com certificates", and lists `comodoca.com`, `sectigo.com` and `trust-provider.com` for Sectigo certificates. Its examples: ```text example.com. IN CAA 0 issue "ssl.com" example.com. IN CAA 0 issuewild "ssl.com" ``` The provider-change article adds that if you already have Sectigo CAA records, add the SSL.com records as well before requesting an SSL.com certificate, or issuance will fail. Keep the Sectigo entries until every Sectigo certificate you still use has been replaced. Check the result with the [CAA checker](https://ssl.sh/tools/caa-checker/) and see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). ## When the certificate is stuck Open **cPanel → Exclusive for Namecheap Customers → Namecheap SSL**. The plugin has the tabs **Ready for installation** and **Installed via Namecheap SSL**, and uses these certificate statuses, as Namecheap words them: - **"In progress"**: "this means that an SSL is being activated, issued and installed". - **"Active"**: "this means that an SSL is issued by certificate authority and installed". - **"Expired"**. Namecheap warns that if the domain is not pointed to the hosting server, "the SSL installation will not be completed, and the certificate will be stuck with the "In progress" status." The plugin normally needs about 25 minutes. To recover, fix DNS, then click **Sync** or **Reconnect** in the plugin, or **Retry** next to the certificate in your Namecheap account's SSL Certificates list. Namecheap's rule: "If the certificate is not issued within 25 minutes, please contact our Support Team for assistance." If you use the cPanel-based **SSL Manager** instead, the statuses are **Validating**, **Pending** ("The SSL manager has activated your SSL, but the Certificate Authority hasn't validated it yet.") and **Installed**. Validation usually takes up to 15 minutes when the domain already points to cPanel, and up to 24 hours otherwise. **Status note, November 2026:** Namecheap's status page reported the Namecheap SSL plugin in cPanel on shared hosting as temporarily unavailable from November 6, 2026, 16:30 UTC, with production testing scheduled for November 10 and a gradual rollout afterwards. Installed certificates, free Standard SSL provisioning and scheduled automatic reissues were not affected. The documented workarounds are to activate or reissue the certificate in your Namecheap account and install it manually in cPanel → SSL/TLS, or to use SSL Manager. Check the [status page](https://www.namecheap.com/status-updates/) for the current state. Behind Cloudflare, Namecheap lists errors such as "525", "SSL Handshake Failed", "526" and "Invalid SSL certificate" when the origin certificate is missing or invalid; pause the proxy until the certificate is Active. ```bash dig +short NS example.com dig +short A example.com dig +short CAA example.com ``` ## Force HTTPS The Namecheap SSL plugin redirects HTTP to HTTPS by default. Namecheap: "HTTPs redirect is enabled by default and once an SSL is installed, a HTTP URL will be redirected to HTTPS." The **Installed via Namecheap SSL** tab has a per-domain **HTTPS Redirect** toggle and an **HTTPS by default** setting for automatically installed certificates; a redirect waiting for its certificate shows "Pending - HTTPS redirect will be enabled as soon as an SSL is installed". The redirect turns off for an expired certificate. For a certificate installed another way, Namecheap's `.htaccess` method in `public_html`: ```apache RewriteEngine On RewriteCond %{HTTPS} !=on RewriteRule .* https://example.com%{REQUEST_URI} [R=301,L] ``` Namecheap's HSTS article lists the prerequisites before adding the header: a valid certificate with no errors, an HTTP-to-HTTPS redirect and no mixed content. The header itself is covered in [enable HSTS](https://ssl.sh/guides/enable-hsts/). ## Fix mixed content Namecheap's answer to "my SSL is installed, why do I get Not secure" is mixed content. Its quick fix is to add this as the first line of the site's `.htaccess`: ```apache Header set Content-Security-Policy "upgrade-insecure-requests" env=HTTPS ``` The lasting fix is to change `http://` links to `https://` or root-relative paths; for WordPress, Namecheap's guide also covers the site URLs under Settings → General and a database search-and-replace. The plugin article warns that some shopping carts (PrestaShop, Magento, OpenCart) can show insecure-content issues after the switch. Find the offenders with the [mixed content scanner](https://ssl.sh/tools/mixed-content-scanner/) and read [mixed content warning](https://ssl.sh/errors/mixed-content-warning/). ## Can you upload your own certificate? Yes. In **cPanel → Security → SSL/TLS → Manage SSL sites**, select the domain, paste the certificate, click **Autofill by Certificate** to fill the private key, add the CA bundle and click **Install Certificate**. Namecheap also installs a certificate from another provider for you if you send it with the full chain, and says "The SSL certificate installation itself is free of charge." SNI lets several certificates share the server's IP. Add the other CA to your CAA records too. Public certificates are capped at 200 days since March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029, so any manually installed certificate becomes a recurring task; see the [cPanel SSL guide](https://ssl.sh/guides/cpanel-ssl/) and [free vs paid SSL](https://ssl.sh/compare/free-vs-paid-ssl/) before buying. ## Verify Once the plugin shows Active, the domain and `www` should present an SSL.com certificate (Sectigo for certificates activated before July 11, 2026), and HTTP should redirect to HTTPS. Check it from outside: ```bash curl ssl.sh/example.com curl ssl.sh/www.example.com curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` The [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the same issuer and names, plus the chain and expiry. The free offer covers one year, so put a reminder in your calendar for the paid renewal and add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development).