Websites · Glossary
What is a managed SSL certificate?
A managed SSL certificate is a TLS certificate that your host or provider requests, validates, installs and renews for you, usually without any cost or action after the first setup. You prove control of the domain once, often with a DNS record, and the provider keeps a valid certificate in place before each one expires.
Every certificate expires, and lifetimes are getting shorter. A managed certificate takes renewal off your list, which is why most website builders and content delivery networks issue them by default.
Nuwan Madhusanka · Co-founder
4 min read · Published
| Question | Managed by the host | Bought from a vendor | Self installed free certificate |
|---|---|---|---|
| Who requests and installs it | The host | You or your developer | You, with a tool such as an ACME client |
| Who renews it | The host, automatically | You, before it expires | Your tool, if it is set to run |
| Typical cost | Included in the plan | A yearly fee | Free |
| Validation level | Domain validation | Domain, organisation or extended | Domain validation |
| Risk of expiry | Low while DNS stays pointed at the host | High if a reminder is missed | Medium; depends on the automation |
What it is
An SSL certificate, more correctly a TLS certificate, binds your domain name to a key pair so browsers can set up an encrypted connection and show that the site really is your domain. What makes a certificate managed is not the certificate itself but who looks after it. A managed certificate is requested from a certificate authority by your host, installed on the host's servers and renewed by the host's automation, so it keeps working as long as your domain points at that host. Most are domain validated certificates from authorities such as Let's Encrypt or the host's own authority.
How it works
After you point your domain at the host, the host proves to a certificate authority that it controls the name. It does this with a DNS record, a file served at a known address or a TLS handshake, under the ACME protocol or a similar process. The authority issues a certificate, the host installs it, and a scheduler renews it well before expiry. Amazon's certificate service, for example, renews DNS validated certificates automatically and emails owners when it cannot. Let's Encrypt certificates are valid for 90 days by default, which only works because renewal is automated. The CA/Browser Forum has voted to cut the maximum lifetime of public TLS certificates from 398 days to 47 days in stages between March 2026 and March 2029, which makes automation close to mandatory.
When it matters
It matters every time you connect a custom domain. A site without a valid certificate shows a full page browser warning, and most visitors leave. Forms, logins and payment pages must run over HTTPS, and browsers mark plain HTTP pages as not secure. For a small business without a developer, a managed certificate removes the most common cause of a site suddenly showing a security warning: a renewal nobody remembered.
Common mistakes
Moving DNS away from the host for a while, so renewal validation fails and the certificate lapses. Adding a DNS provider proxy that blocks the host's validation request. Buying an extended validation certificate expecting a green bar, which modern browsers no longer show. Assuming the www and bare versions are covered by one certificate when only one was added. And ignoring renewal failure emails from the host, which usually arrive weeks before anything breaks.
Where it shows up in OneCraft
When you connect a custom domain to a published OneCraft site, you add a TXT record at _onecraft followed by your host name and a CNAME, then press Verify, and a managed certificate is issued for that host. Apex hosts need an ALIAS or ANAME record. The free onecraft.live address works over HTTPS without any setup. Custom domains need a paid plan: Starter allows 1, Pro 5, and Pro+ and up have no cap.
Questions people ask
Is a managed certificate less secure than a paid one?
No. Encryption strength is the same for domain validated, organisation validated and extended validation certificates. Paid certificates add identity checks on the organisation and sometimes a warranty, but browsers show them the same way. For a small business site, a managed domain validated certificate gives visitors the same padlock and protection.
Why did my certificate stop working after I changed DNS?
Managed certificates renew only while the host can still prove control of the domain. If DNS now points elsewhere, or a proxy blocks the validation check, renewal fails and the certificate eventually expires. Point the records back to the host, or add the domain again, and the host can issue a fresh certificate.
Do I need a certificate for the www and bare domain?
Each host name needs to be covered, either by its own certificate or by one certificate listing both names. Hosts usually issue one per host you add. If people can reach both versions, make sure both are covered and that one redirects to the other.
How long are SSL certificates valid now?
Public certificates can currently be valid for up to 398 days, and many free ones, such as Let's Encrypt's defaults, last 90 days. The CA/Browser Forum has agreed a schedule that reduces the maximum to 47 days by March 2029, which is why automatic renewal is becoming the norm.
Can I bring my own certificate to a website builder?
Some hosts allow it on higher plans, mostly for organisation or extended validation certificates a company already owns. Many builders, especially those that issue certificates per custom domain, only use their own managed certificates. Check before buying one, because a certificate you cannot install is wasted money.
Make one with websites
The button opens the generator with this use case already described. Change the wording to match your own.
Create a website with OneCraftRelated questions
- What is an SSL certificate?What is an SSL certificate? The file that lets a site use HTTPS, proving the domain and encrypting traffic. Why every site needs one and why most are free now.
- What is an apex domain?What is an apex domain? The bare domain with no subdomain, why it cannot hold a CNAME record, and how ALIAS, ANAME and CNAME flattening solve that.
- What is a TXT record?What is a TXT record? A DNS record that holds text, used to prove you own a domain and to publish SPF, DKIM and DMARC email rules, with examples.
- What is a service worker?What is a service worker? A browser script that runs apart from the page, intercepts requests and caches files so a site loads fast and shows an offline page.
Written and checked by the OneCraft team. Last checked .