Free SSL done right: what a host should automate for you

Certificates should be invisible infrastructure. A checklist of what 'managed TLS' must include — and what VeloxaHost automates.

If you're still manually renewing certificates in 2026, your host is offloading work that is trivially automatable. Here's the checklist we hold ourselves to.

The non-negotiables

• Automatic issuance — first certificate within minutes of DNS pointing at the host.
• Automatic renewal — no emails asking you to click anything.
• Automatic redirects — HTTP → HTTPS from day one.
• Modern TLS only — TLS 1.2 minimum, 1.3 preferred, modern ciphers.

Nice to have

• HTTP/3 enabled by default.
• OCSP stapling.
• Separate certs per site (no shared-SNI certificate pinning your migration).

How we do it

Every VeloxaHost site runs Caddy, which handles issuance, renewal, redirect, HTTP/3 and modern ciphers with zero configuration. You point DNS; encryption appears. That's the correct division of labour — your time belongs to your application, not to certificate paperwork.