Shared SSL folders

A shared SSL folder lets a customer serve part of their site over HTTPS using a certificate belonging to the platform, rather than one issued for their own domain.

The content is reached through the platform’s secure hostname instead of the customer’s, so a checkout or login page can be encrypted without the customer buying and maintaining a certificate.

Web > Shared SSL appears when the hosting plan allocates the shared SSL quota.

The trade-off

The address bar shows the platform's domain, not the customer's

Because the certificate belongs to the platform, a visitor moving into a shared SSL folder sees the hosting provider’s hostname in the address bar.

For a checkout or a login form that is a problem: it looks exactly like the redirection a phishing attempt performs, and careful visitors abandon at that point. Shared SSL is a reasonable answer for an internal tool or a low-traffic form, and a poor one for a public commerce page.

When to use a real certificate instead

A certificate issued for the customer’s own domain keeps the address bar consistent and is the right answer for anything customer-facing. Free issuing authorities have made the cost argument for shared SSL much weaker than it once was.

Use shared SSL where a certificate genuinely cannot be issued — an internal hostname, or a short-lived environment.

Check what is actually in the folder

Shared SSL folders accumulate. A folder set up years ago for one form may now hold more than intended, still served under someone else’s certificate. Worth reviewing alongside the certificates the customer holds properly.

Related

• Websites
• Certificates

Folder properties

Shared SSL Folder Properties opens an individual shared SSL folder — the mapping between the folder and the site it secures. Edit it here rather than recreating the folder, which changes the URL customers have already been given.