SiteGround SSL: Let's Encrypt in Site Tools, installation errors and HTTPS Enforce

SiteGround issues free Let's Encrypt certificates for every site in Site Tools and renews them automatically. On a new site it tries to install one by itself, which can take up to 72 hours after the domain is pointed. If the certificate does not appear, SSL Manager usually reports one of three errors that all come down to DNS.

HTTPS Enforce forces HTTPS, and Speed Optimizer cleans up mixed content. Steps and screen names follow the SiteGround Knowledge Base as of November 2026.

How SiteGround issues certificates

SiteGround offers three certificate types: "Let's Encrypt SSL", "Let's Encrypt Wildcard SSL" and the paid "Premium Wildcard SSL". The KB says all hosting plans include free standard and wildcard Let's Encrypt certificates, and the Premium Wildcard is issued by a trusted vendor, GlobalSign. For a new site, SiteGround states: "By default, we try to automatically issue a free Let's Encrypt SSL certificate for each site created on our platform." It also warns that "The installation process may take up to 72 hours after the domain of your site has been registered" or pointed to SiteGround.

As of November 2026 the KB describes free Let's Encrypt certificates as valid for 90 days and renewed automatically 30 days before expiry. Let's Encrypt's default lifetime drops to 64 days on February 10, 2027 and 45 days on February 16, 2028; renewal stays automatic, but there is less time to notice a DNS problem.

Point your domain to SiteGround

The certificate can only be issued once the domain resolves to the SiteGround server. You have two options:

• Nameservers: set ns1.siteground.net and ns2.siteground.net at your registrar. You can then manage records in Site Tools → Domain → DNS Zone Editor; SiteGround notes "You can manage DNS records only if your domain is pointed to our name servers."
• A record: keep your DNS host and "update only the domain's A record to point to your hosting account's IP address". The IP and nameservers are under Client Area → Websites → Website Settings → Server Details.

Point www as well (an A record to the same IP or a CNAME to the root), since the certificate covers both names.

CAA records: allow letsencrypt.org

If your domain publishes CAA records, they must allow the CA that issues your SiteGround certificate. SiteGround's KB does not cover CAA, and its DNS Zone Editor documentation lists A, AAAA, CNAME, MX, SRV and TXT records, so CAA records on a SiteGround site usually live at an outside DNS host. For the free certificates the CA is Let's Encrypt, whose CAA identifier is letsencrypt.org:

example.com.  3600  IN  CAA  0 issue "letsencrypt.org"

An issue record also governs wildcard certificates unless the domain has issuewild records; if it does, add 0 issuewild "letsencrypt.org" as well before requesting the Let's Encrypt Wildcard SSL.

For a Premium Wildcard SSL, allow GlobalSign using the identifier from GlobalSign's documentation. Check the published records with the CAA checker; a CAA failure looks like CAA record prevents issuance.

When the certificate does not install

Open Site Tools → Security → SSL Manager. A working certificate is listed as Active in the Manage SSL table. If automatic provisioning has not happened after 72 hours, install it manually: Install New SSL → select the domain → Let's Encrypt → Get.

SiteGround's error article lists three Let's Encrypt installation errors, quoted as written:

• "429 Too Many Requests"
• "No Domains Authorized"
• "Certificate is not for the chosen domain."

SiteGround attributes all three to the same root cause: "your domain name is not pointed properly or has been registered or pointed recently". The fix is to make sure the domain points to the right server, wait for propagation (SiteGround allows up to 72 hours after any DNS change), and then install again. Repeated attempts while DNS is wrong count against Let's Encrypt's limits, which is what a 429 means; see Let's Encrypt rate limits. For other problems, SiteGround's advice is to delete the SSL that causes issues and install it anew.

If the site sits behind Cloudflare, SiteGround's KB says to change Cloudflare's SSL setting from "Flexible" to "Strict" once the origin certificate is installed, so Cloudflare connects to the server over verified HTTPS. Confirm DNS before retrying:

dig +short NS example.com
dig +short A example.com
dig +short A www.example.com
dig +short CAA example.com

The Renew option in SSL Manager stays inactive until 30 days before a SiteGround-issued certificate expires, so there is no need to renew by hand earlier.

Force HTTPS with HTTPS Enforce

Turn on HTTPS per domain in Site Tools → Security → HTTPS Enforce; subdomains and parked domains have their own switches, and the ⋮ menu next to a certificate in SSL Manager links there. SiteGround adds: "We highly recommend that you configure the HTTPS in your application, whenever possible". For WordPress that means the SiteGround Speed Optimizer plugin: open Environment and switch on HTTPS Enforce, which adds the redirect rule to .htaccess. Use one method, not both, to avoid redirect loops. SiteGround's current KB has no HSTS switch; add the header yourself as described in enable HSTS once every subdomain works over HTTPS.

Fix mixed content

SiteGround offers three WordPress tools for mixed content, which it defines as items "that are requested via HTTP":

• HTTPS Enforce in Speed Optimizer, as above.
• Fix Insecure Content in Speed Optimizer → Environment: "This option will dynamically rewrite insecurely loaded resources to go through https." SiteGround suggests enabling it only if warnings remain, since it adds processing overhead.
• Search & Replace in Site Tools, to change stored http://example.com URLs to https://example.com in the database permanently.

For other applications, find and fix the http:// references manually. The mixed content scanner lists them page by page; mixed content warning explains how browsers react.

Can you upload your own certificate?

Yes. "You can install third-party SSL certificates through Site Tools." Go to Site Tools → Security → SSL Manager → Install New SSL → Import and paste the certificate (CRT), private key (KEY) and CA bundle (CABUNDLE); SiteGround reminds you to make sure the certificate covers the naked domain name. Imported certificates cannot be renewed through SiteGround. Public certificates have been limited to 200 days since March 15, 2026 and will be limited to 100 days from March 15, 2027 and 47 days from March 15, 2029, so an imported certificate means a manual swap several times a year. Unless you need OV or EV validation, the free Let's Encrypt certificate is less work.

Verify

After the status turns Active, the issuer should be Let's Encrypt (or your CA for an imported certificate), with both names covered and the chain complete. Test from outside:

curl ssl.sh/example.com
curl ssl.sh/www.example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The SSL checker shows the same in a browser. Let's Encrypt stopped sending expiry emails on June 4, 2025, so add the domain to ssl.sh monitoring (in development) if you want an alert when a renewal fails.