SSL & TLS certificates

Question 1

What is SSL/TLS in simple terms?

Accepted Answer

TLS (often still called SSL) encrypts the connection between visitors and your site so passwords, payments and form data cannot be read in transit.

Question 2

Why does HTTPS matter beyond security?

Accepted Answer

HTTPS unlocks modern browser features (geolocation, push notifications, HTTP/2), is a ranking signal in Google, and removes the 'Not secure' warning in browsers.

Question 3

Is SSL included free with Blanca's Builder?

Accepted Answer

Yes. Every custom domain gets a free Let's Encrypt certificate that renews automatically. There is nothing to buy or configure.

Question 4

How is the certificate issued for my domain?

Accepted Answer

When you connect a domain, the platform proves control via an HTTP challenge or DNS challenge to Let's Encrypt, which issues a 90-day certificate that auto-renews.

Question 5

Do I need to renew my certificate manually?

Accepted Answer

No. Renewal happens 30 days before expiry. You only need to act if the domain stops resolving — renewal needs DNS to be intact.

Question 6

Do you support wildcard certificates?

Accepted Answer

Yes, on Builder and higher. Wildcards (*.example.com) need DNS-based validation and are issued automatically when you add a wildcard subdomain at /domain.

Question 7

Do you offer Extended Validation (EV) certificates?

Accepted Answer

No. Browsers no longer show EV indicators differently from DV, so EV is no longer recommended. We use trusted DV certificates from Let's Encrypt.

Question 8

What is HSTS and is it enabled?

Accepted Answer

HSTS tells browsers to always use HTTPS for your domain, preventing downgrade attacks. It is enabled by default with a 6-month max-age after first launch.

Question 9

Should I enable HSTS preload?

Accepted Answer

Optional. Preloading hard-codes HTTPS into browsers but is hard to undo. Enable it only when you are 100% certain every subdomain will stay on HTTPS forever.

Question 10

Visitors see an SSL error in their browser. What now?

Accepted Answer

Check /domain for certificate status. The common causes are DNS pointing somewhere else, a clock skew on the visitor's device, or an extension intercepting TLS.

Question 11

Is HTTP automatically redirected to HTTPS?

Accepted Answer

Yes. Every HTTP request is 301-redirected to HTTPS at the edge. No configuration required.

Question 12

Can I upload my own certificate?

Accepted Answer

Yes, on Enterprise. Upload a PEM-encoded certificate and private key in Settings, Domains, Custom certificate. Renewal is then your responsibility.

Question 13

Which TLS versions are supported?

Accepted Answer

TLS 1.2 and TLS 1.3 only. TLS 1.0 and 1.1 are disabled because they are no longer secure. This matches PCI-DSS and most compliance baselines.

Question 14

Which cipher suites are allowed?

Accepted Answer

Modern AEAD suites with forward secrecy (ECDHE + AES-GCM or ChaCha20-Poly1305). RC4, 3DES and CBC suites are disabled.

Question 15

What rating does my site get on SSL Labs?

Accepted Answer

A+ by default. The Blanca's Builder edge configuration covers HSTS, modern cipher suites and OCSP stapling out of the box.

Question 16

Is certificate transparency supported?

Accepted Answer

Yes. Every certificate is logged in public CT logs, which Chrome and Safari require. You can monitor issuance for your domain at crt.sh.

Question 17

Do you support mutual TLS for API clients?

Accepted Answer

Yes, on Enterprise. mTLS can be enabled per route under Settings, Security. Client certificates are managed through your existing PKI.

Question 18

Why do other hosts charge for SSL?

Accepted Answer

Because they predate Let's Encrypt or sell EV/OV certificates as add-ons. Modern automated DV certificates are essentially free.

Question 19

Do staging URLs also use HTTPS?

Accepted Answer

Yes. Every blancasbuilder.com subdomain — including preview and staging — has a valid certificate from the wildcard.

Question 20

Do TLS certificates apply to my email too?

Accepted Answer

No. Email TLS uses separate certificates issued by your mail provider (often Cloudflare, Google or Resend). Connecting your domain here does not change email.