Check the names you need
Request a certificate only for hostnames that reach this service, then check the certificate actually served for each name.
Start with the exact website names people will visit over HTTPS. Confirm each resolves to the intended hosting service and that the website is accessible. A certificate for one name does not automatically cover every subdomain. Domain validation and service setup must succeed before a certificate can be issued.
Request the certificate
- At DirectAdmin User level, select the domain and open SSL Certificates.
- Review the available automatic certificate option and select only the hostnames that are configured and needed. Interface wording and certificate authority options depend on the server setup.
- Save or request issuance. For a wildcard, expect DNS-based validation and an authorised DNS provider integration; do not enter a DNS API token unless you understand the permission granted.
Check the deployed result
Visit each hostname over HTTPS and inspect the browser certificate name, validity and issuer. Test HTTP to HTTPS redirection separately. If validation fails, check authoritative A/AAAA records, nameserver consistency, DNSSEC health and any restrictive CAA record. A stale AAAA record can send validation to the wrong host even when A is correct. Capture the exact error and the selected names before retrying.
For example, if www.example.com presents an old certificate while the apex is valid, compare its DNS, proxy and virtual-host mapping. Requesting another apex certificate alone cannot prove www is fixed.
What the certificate covers
TLS protects the connection to the hostname; it does not fix an insecure application or certify the business behind a domain. For included certificates, issuance follows domain validation and service setup. The domain owner controls external DNS and application content. Novasean can investigate issuance on its hosting service; ask support before repeated requests when the cause is unclear.
Identify the failing validation path
For each requested hostname, query A and AAAA at an authoritative nameserver and compare them with the intended hosting target. Check that the domain is active and its nameservers are correct. A certificate authority must validate control of every requested name. If one optional alias points elsewhere or has expired, remove it from the request or correct its DNS before retrying. Wildcards require DNS validation; ordinary hostnames may use an HTTP challenge, depending on panel configuration.
| Symptom | Likely cause | Safe next check |
|---|---|---|
| Validation cannot reach the site | Wrong A/AAAA, firewall, proxy or web routing | Query each address family and inspect the named site's HTTP response. |
| One selected name fails | Alias or subdomain points away | Test that name individually and remove unintended names. |
| CAA error | DNS policy does not allow the chosen issuer | Review CAA at the authoritative zone with the domain owner. |
| Browser still shows old certificate | Wrong virtual host, proxy or cached deployment | Inspect the presented certificate for the exact hostname. |
Verify coverage and renewal
After issuance, test the apex, www and each selected subdomain separately. Read the certificate's Subject Alternative Names; the browser padlock alone does not prove that all names are covered. Check the validity dates and whether the panel shows automatic renewal. A certificate for the website hostname may differ from the certificate used by the mail server or DirectAdmin login; use the service hostname supplied for those connections.
Keep a copy of the pre-change certificate settings and the exact validation error if a request fails. Repeated requests without fixing DNS can hit certificate-authority rate limits. If using an external DNS provider such as Cloudflare, edit DNS at the authoritative provider and check whether proxying changes the validation path; do not assume the DirectAdmin DNS zone controls the public answer.
Does HTTPS mean the application is secure? No. It encrypts transport to the certified hostname but does not patch the site. Should I request a wildcard for one website? Usually only if you actually need many subdomains and can manage the required DNS validation.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.