Certificate problem when using subdomains and the importance of HTTPS access

When using one of the free subdomains to serve the website (such as “webutu”, or anything else except “000webhost”), there is a browser warning of a certificate problem and the website is blocked by default. In a nutshell, the problem is that the certificate belongs to “000webhost” even though the domain is “webutu”.

I am aware that similar questions were raised before (tried to add a link but the system won’t let me), but please let me explain why I find the response of @Infinity unsatisfactory. The suggestion was to force use of HTTP rather than HTTPS claiming that HTTPS is not needed unless credit card information is being submitted. Respectfully, I completely disagree with this approach and I think most or even all security professionals advocate the use of HTTPS for all web content. Specifically, HTTPS is not just used for encryption of transaction content (which is important for the credit card transaction example) but also for authentication (certifying that the website you are contacting is the website you intended to contact). This is important since someone can post a website with fake or harmful information that pretends to be served from your address.

I therefore think it is very important to encourage users to use HTTPS at all times, and to resolve the certificate problem by issuing correct certificates for the alternative domains rather than suggesting the workaround.

Thank you very much!

Link to similar previous discussion: My site is not secure? - Google chrome warning users (https)

https works fine with *.000webhostapp.com…due to shared SSL.
But it don’t work for custom domain.

If you want you can switch to cloudflare.(cloudflare provide free SSL)

Or upgrade to premium hosting. As premium has SSL/TLS Manager!!!

Thank you very much for your response! Of course I cannot complain for not getting everything I want in the free service (which I appreciate very much). I just thought that since you provide the option of free subdomain, serving the website with correct certificate might be easy to fix and was possibly just overlooked (I’m specifically talking about domains that are managed by you and not third parties). I now understand that this is not the case and HTTPS is not intended to be supported in the free service. If you consider adding it in the future to the free subdomain option that would be great, but either way thanks for the service.

1 Like

I doubt 000webhost will add SSL for free subdomain.
You have alternatives:-
Instead of using free subdomain…you can register a free custom domain using Freenom with “.tk”,".ga",“ml”,".cf" as extensions(http://www.freenom.com).
after completing the process…just switch switch to cloudflare.

Thanks again. I still think that it is in 000webhost’s benefit to allow secure HTTPS connection to websites that it hosts and encourage responsible and secure internet usage. And I still wonder whether this is just some configuration error and not an purposeful policy, since the website does seem to accept HTTPS connections, it only signs them with the wrong certificate (although perhaps the point is that 000webhost does not want to pay for certificates for all of those other free domains). Do you think there is a way to get an official response?

@SunshineAlpha As per the Admin…Already 000webhost is working on free SSL support for all custom domain names but there is no time scale on when it will start.

1 Like

I’m sorry, are you saying that i have to buy a certificate to get free hosting?

No, what we mean is that we do not support the installation of SSL certificates on free hosting plans. You can use Cloudflare to get SSL, but this seems to only work for some people. If you really want SSL, upgrade to a premium plan that supports SSL.

I was asking because, I’m getting redirected onto https:// on my domain, and it’s bumping back to the old server to get

HTTPS is free only for yoursite.000webhostapp.com - THAT IS ALL because 000webhost have paid and purchased a certificate for “000webhostapp.com

You need to buy one for YOURSITE.COM if you want HTTPS

Just don’t use HTTPS

Hi! How can i do that? I mean, to not work with https in my website??? Plis the security certification matter is driving me crazy!!! Thanks!