Hosting SSL: who issues the cert at signup

Free SSL still sells. A lot of the time it is Let's Encrypt on their box, a Cloudflare Flexible setup that talks HTTP to the origin, or a cert that lives in their panel and dies when you leave. Before you buy, find out who issues it and whether it survives a move.

I have pointed a domain at a new host, watched the padlock appear in an hour, and felt very grown up. Then I tried to leave. Their panel owned the certificate. AutoSSL would not run against nameservers I controlled. Cloudflare was on Flexible, so the edge spoke HTTPS to visitors and HTTP to the box, and the sales chat called that "included SSL." If you are already comparing hosts without leaning on top 10 roundups, pair this with email and DNS ownership and how to choose web hosting without relying on top 10 lists. For why sales copy and review copy so often rhyme, read The Truth About Hosting Review Sites.

A padlock is not a cert you own

A real setup is boring. Someone issues a certificate for your hostname, the origin serves HTTPS, the browser trusts it, and you can reissue it if the host changes. You can usually see the issuer, the expiry, and whether renewal is automatic.

What hosts actually ship under "free SSL":

Let's Encrypt on their box, issued through AutoSSL or a similar cron they run
A certificate that only exists inside their control panel, with no private key you can export
Cloudflare Flexible, so visitors see a padlock while the origin still talks HTTP
A paid "EV" or "wildcard" upsell for a hostname they already cover with Let's Encrypt

Those can still work. Let's Encrypt on the origin is fine if they renew it and you can point the same name at a new box later. The problem is ownership. If they hold the only copy, leaving means a day of browser warnings while you wait for a new issue. If they hold the Cloudflare zone, they decide whether the origin ever sees HTTPS at all.

What's all the fuss with Heartbleed? is the 2014 version of this worry: a padlock is not the whole story. A padlock on a cert you cannot take with you is the 2026 version.

Flexible vs Full (strict) is not a branding choice

People mash these together because the pricing table only has room for one badge.

Flexible terminates HTTPS at the edge and talks HTTP to the origin. Visitors see a lock. The hop between Cloudflare (or whoever) and the box is plain text. Anyone on that path can read it. Mixed content bugs also love this mode.
Full talks HTTPS to the origin, but will accept a self-signed or name-mismatched cert. Better than Flexible. Still a shrug if the host cannot show you a real certificate on the hostname you typed.
Full (strict) talks HTTPS to the origin and checks the cert is valid for that name. This is the one you want if there is an edge in front of the box.

If they cannot say which mode they use, they are guessing, or they are on Flexible and hoping you do not ask. We already poke at this in what the host actually controls at the edge. Ask it again here, because "free SSL" and "free CDN" are often the same lock-in wearing two stickers.

A WordPress install that hardcodes http:// in the database will sit behind a pretty lock and still leak cookies on the origin hop. A WooCommerce checkout that only looks secure in the browser is the expensive version of that.

Ask who issues it, and what happens when you leave

Before you buy, send the same short question to every host on your shortlist:

On this plan, who issues the SSL certificate, Let's Encrypt, you, or a CDN in front? Is the origin on HTTPS, or only the edge? If you use Cloudflare, is it Flexible or Full (strict)? Can I export or reissue the cert if I move? What happens to HTTPS on the day I cancel?

Save the reply. "We include free SSL" is not an answer. "The padlock appears automatically" is not an answer either.

Push on the boring edges:

Can you install your own certificate, or only theirs?
Do they cover www and the bare domain, or just whichever one the signup wizard liked?
Will they issue for add-on domains and staging hostnames, or only the primary site?
If you already use Cloudflare, can you bring your own zone and still get an origin cert?
Do they need to control DNS for AutoSSL to renew, so pointing nameservers away kills the cert?

A host that will paste the issuer, the mode, and what happens on cancel is taking you seriously. A host that says "just wait, the lock will show up" is counting on you to forget.

This is also a support test. Ask about Full (strict) and a move before you pay. If chat goes quiet, or they say SSL "does not work with other CDNs," you have the answer.

The cert should be able to leave with you

Plenty of sites already have a certificate, or they will the minute they point DNS. The host does not need to keep the only copy.

What you want in writing:

HTTPS on the origin, not only at their edge
A way to issue or install a cert on the plan you are buying, without a phone call
Renewal that still works if you use your own nameservers
No requirement that their panel stays in the path "for SSL to work"

If the cheap plan only gets a padlock when you use their zone, the lock is not the plan. It is a product they can turn off, throttle, or put behind a higher tier later. Same pattern as renewal pricing add-ons: the advertised security is the upsell.

A VPS does not magically give you a portable cert either. It gives you a box you can put Caddy or Certbot on, and then you still need DNS you control or the renewals fail on a Sunday.

Red flags worth pausing on

Be careful when:

Free SSL is on the pricing table and they cannot name the issuer, the mode, or what happens if you leave
Chat will talk about "padlocks" and "secure checkout" all day and go quiet when you ask about Flexible vs Full (strict)
AutoSSL only runs if their nameservers stay pointed at them
Staging copies get a shared or expired cert, or none at all
Reviews praise "SSL included" and never mention a move, a www mismatch, or a day of browser warnings

Useful hosts treat HTTPS as something you can see: an issuer, an expiry, and a way to reissue it on a new box. Useful reviews mention the Tuesday the lock vanished after a nameserver change. If neither does, you are reading advertising.

We care about this for the same reason we care about email and DNS and migrations: the real product is a hostname you can still serve securely when plans change, not a welcome wizard that hides the certificate. Our FAQ on who issues SSL at signup is the short version. A cert you cannot take with you is just another sticker.

The best course of action is still the boring one. Ask the same SSL questions of every shortlisted host, try a hostname they did not pre-install on the trial if they offer one, and treat any free SSL pitch as marketing until they show you the issuer and the mode. Browse more web hosting guides and keep the homepage ranking list handy while you compare.