SSL renewal — automatic vs manual.

SSL certificates expire. With Let's Encrypt at Rivervo, renewal is automatic — but here's what to know in case it isn't.

The automatic process

Our certificate service runs a daily check. If any cert is within 30 days of expiry:

1. It contacts Let's Encrypt
2. Generates a new cert
3. Installs it on the domain
4. Old cert is replaced seamlessly — no downtime

You won't notice. Browsers see the new cert on next page load.

Verifying renewal worked

Project → Website → SSL.

For each address it shows the certificate and until when it is valid. «All N addresses are protected» means everything is fine; otherwise it lists the addresses without a valid certificate.

Why issuing might fail

Domain doesn't resolve to your server. The service needs Let's Encrypt to verify the domain by reaching http://yourdomain.com/.well-known/acme-challenge/.... If DNS points elsewhere or the domain doesn't resolve, validation fails.

Fix: point the domain at your server (see Connect existing domain) and wait for DNS to propagate.

.well-known/ is blocked or rewritten. Some .htaccess rules accidentally block this path. Common with security plugins or aggressive rewrite rules.

Check public_html/.htaccess for lines like RewriteRule ^.well-known/ and remove them. Or add an explicit allow:

RewriteEngine On
RewriteRule ^\.well-known/ - [L]

Cloudflare is in front in proxied (orange cloud) mode. The check reaches Cloudflare instead of your hosting.

Fix: temporarily switch the DNS record to grey cloud (DNS only), run Check certificates now, switch back. Or use Cloudflare's Origin CA cert instead of Let's Encrypt.

Subdomain not on the hosting. Certificates cover the domains and subdomains added to the hosting. If you add app.yourdomain.com only as a DNS record, no certificate is issued for it.

Fix: add the subdomain under Website → Domains → New subdomain.

Force manual renewal

Website → SSL → Check certificates now.

Missing or expiring certificates are issued within a few minutes. Refresh the page.

Custom (non-Let's Encrypt) certs

If you bought a cert from a CA (Sectigo, DigiCert, GoDaddy SSL):

1. Website → SSL → Install your own certificate
2. Pick the domain
3. Paste the Certificate (CRT), the Private key (KEY) and the Chain (CA bundle) from the CA. Made the request (CSR) under Certificate requests (CSR) here? Leave the key empty — it is on the hosting
4. Install

Free certificates will not replace it.

These don't auto-renew. You manage renewal at the CA, get the new files, repeat the install.

Wildcard certs

Let's Encrypt can issue wildcard certificates (*.yourdomain.com), but only with a DNS-based check. If you need a wildcard certificate on your hosting, write to support (Help → Write to us) — it isn't something you can trigger yourself. In most cases you don't need one: every domain and subdomain you add to the hosting gets its own free certificate.

Mixed content warnings after SSL

You enabled SSL but the browser still shows "Not Secure" for some pages?

Cause: HTTP-loaded resources (images, scripts, CSS) on an HTTPS page.

Fix: in WordPress, install Really Simple SSL plugin, run it. For other apps, search the codebase for http://yourdomain.com and replace with https://.

Or force HTTPS in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]