Supporting free SSL

[FredSheehan]

Not after support as such…

After trying and failing to use the free lets encrypt ssl certificate service, and it failing, I had a read through the knowledge base, and realised it just isn’t possible on Infinity Free due to the ‘bot’ of lets encrypt not being able to access the needed acme files on the server, so certificate generation fails.

You don’t allow SSH access either, so I have no way of using certbot or similar on the server itself to generate the certs.

Many of the commercial SSL providers will give you a free cert you could install manually, however they typically have either a 30 day expiry, or in some cases, a 90 day expiry, however they cannot be renewed, so after that your back to the self signed certs only, and no ‘proper’ SSL that will give me the ‘secured’ bit in browsers.

I have seen it suggested in some posts to use Cloudflare DNS and hence their own SSL set up, but what is the point in that?

It seems that the only way to get a proper SSL certificate on Infinity is to pay for one and upload, but this defeats the point of using free hosting, many paid for hosts will let you use the free lets encrypt service directly from a cPanel.

I appreciate the need to keep free domains secure, and the rational behind it in terms of support needs, but surely allowing the free lets encrypt service to be accessible, or actually building it into your cPanel set up would make sense?

I know my site will work with only a self signed cert, but in this day and age even basic sites should be encrypted, to protect any sign up forms or similar, i.e. protecting the data of the visitors to my site, whom I might want to later email etc, I myself always use HTTPS rather than HTTP and its ‘best practice’ to do so now.

I appreciate the service has been going longer than the free SSL providers have, so the security features that prevent it have been around longer, but why can’t it be updated to allow a free service to be used with your free hosting?

If I have to pay for an SSL cert that doesnt’ expire, I may as well choose a paid hosting provider who allows me to use a free SSL provider, the cost will be far less!

[Admin]

You make a very strong case, and I agree with pretty much everything you said.

I wholly agree that every site should be secure and that some way to support free SSL certificates is pretty much necessary for free hosting.

That is why we are trying to rebuild the SSL system in a way we can offer free SSL certificates to everyone. We want to make this work on subdomains and custom domains, and this should all be done completely automatically. But this, in some ways, is still the “easy” part.

However, our current SSL system predates Let’s Encrypt, and was designed in a time where SSL for many websites, especially on free hosting, was quite rare. So there are some substantial technical challenges to overcome before we can actually do that.

Sophisticated optimizations and customizations have been made in order to make the free hosting platform run fast and reliably in a cost effective way, but some of these optimizations make it really hard to offer SSL for everyone. This is something we’re still working on fixing.

[FredSheehan]

Thank you for your reply

I realised from the knowledge base answers, and also the fact that the free lets encrypt service is still relatively ‘new’, in comparison to how long you have been offering free hosting, that your systems pre date these new free SSL certificate services.

The fact that it is being looked at, and worked on, is great to hear, I look forward to the day when it is implemented!

For a free hosting provider, you already offer, and support, a great deal of web technologies, so this wasn’t a complaint, and your answer has indicated that this is on your roadmap as it were, so thank you for the free hosting platform, and for your thoughts.