# Certificates installed by Host- Passes test- no padlock? **URL:** \ **Category:** Help\ **Created:** [December 31, 2017, 4:48am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267 "2017-12-31T04:48:25Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Donske](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Donske](https://community.letsencrypt.org/u/Donske)\ **Post date:** [December 31, 2017, 4:48am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/1 "2017-12-31T04:48:25Z")
To the experts here: First, I apologize for being so “wordy”, but I figure the more info I can provide the better. I am not an expert and on my own struggling with this,I finally turned here for help. I am hoping that perhaps someone can offer guidance and advice. I would really appreciate it. So, therefore, I speak with a lot of ignorance of SSL and TLS, Shells, etc. I asked my host (Hawk Host) to set me up with SSL and they suggested the Let’s Encrypt and they installed it for me. I can go to my cPanel at the SSL management icon and I can see all the URL’s listed has a padlock. I also see these three sets of items: 1. Certificate: (CRT) 2. Private Key (KEY) 3. Certificate Authority Bundle: (CABUNDLE) and also listed are the padlocked URLs [cpanel.shipsofscale.com](http://cpanel.shipsofscale.com) [mail.shipsofscale.com](http://mail.shipsofscale.com) [shipsofscale.com](http://shipsofscale.com) [webdisk.shipsofscale.com](http://webdisk.shipsofscale.com) [webmail.shipsofscale.com](http://webmail.shipsofscale.com) [www.shipsofscale.com](http://www.shipsofscale.com) (even though sadly, I do not understand all of this at this time) The support at Hawk Host ran whynopadlock for me and sent me the results. It had a huge list of items that needed attention and as I read the error, I figured out intuitively that all the links that were embedded all through-out my site had [http://shipsofscale/](http://shipsofscale/)… and I realized that perhaps, I needed to change ALL of those http into https - - and I did. I ran the whynopadlock again and it all was _clear_ no errors. I attached what I think is a link to the results page. [https://www.whynopadlock.com/results/e35d4387-a8f9-45da-a81a-f1c40afe8229](https://www.whynopadlock.com/results/e35d4387-a8f9-45da-a81a-f1c40afe8229) Now, after this, I come here to find out, what am I doing wrong ? First, I have an assumption. I assume that if I enter [shipsofscale.com](http://shipsofscale.com) in the address bar, that my site will come up with the green padlock and the URL will change over to [https://shipsofscale.com](https://shipsofscale.com) but it does not. On all browsers such as FF, Opera, MSIE, they all show that this site is unsecured. So, in my logic, I am thinking that somehow there needs to be a redirect or some type of instruction set that will tell the browser to change to the secured https version. The whynopadlock suggested adding a few lines of code into the .htaccess page and I tried that with no success, **but** , that was before I cleaned up my site pages. I used cPanel using the MultiPHP INI Editor. However, since my site has cleaned up according to whynopadlock, I have not tried to enter that code again. I am wondering if I should try that code again since I do not have any errors, but I would like to see what is suggested here first. This is what was recommended by WNP RewriteCond %{HTTP\_HOST} [shipsofscale.com](http://shipsofscale.com) [NC] RewriteCond %{SERVER\_PORT} 80 RewriteRule ^(.\*)$ [https://shipsofscale.com/$1](https://shipsofscale.com/%241) [R,L] My domain is:[http://www.shipsofscale.com](http://www.shipsofscale.com) I ran this command: It produced this output: My web server is (include version): LiteSpeed The operating system my web server runs on is (include version): Linux My hosting provider, if applicable, is: Hawk Host I can login to a root shell on my machine (yes or no, or I don’t know): I don’t know, but I have cPanel and it has SSH access, but I do not know how to use it nor set it up. I’m using a control panel to manage my site (no, or provide the name and version of the control panel): Yes, cPanel thank you kindly D. Driskell Ships of Scale ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [December 31, 2017, 6:19am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/2 "2017-12-31T06:19:54Z")
So, in summary, you want to redirect the insecure version of your website to the HTTPS variant. That .htaccess change actually looks suitable for what you need. I am surprised to hear it did not work. Could you post your full, current .htaccess file? ---
**Author:** ![Donske](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Donske](https://community.letsencrypt.org/u/Donske)\ **Post date:** [December 31, 2017, 6:31am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/3 "2017-12-31T06:31:33Z")
; cPanel-generated php ini directives, do not edit ; Manual editing of this file may result in unexpected behavior. ; To make changes to this file, use the cPanel MultiPHP INI Editor (Home \>\> Software \>\> MultiPHP INI Editor) ; For more information, read our documentation ([https://go.cpanel.net/EA4ModifyINI](https://go.cpanel.net/EA4ModifyINI)) asp\_tags = Off display\_errors = Off max\_execution\_time = 30 max\_input\_time = 60 max\_input\_vars = 1000 memory\_limit = 128M post\_max\_size = 14M session.gc\_maxlifetime = 1440 session.save\_path = "/var/cpanel/php/sessions/ea-php56" upload\_max\_filesize = 12M zlib.output\_compression = Off ---
**Author:** ![\_az](https://avatars.discourse-cdn.com/v4/letter/_/22d042/32.png) [@\_az](https://community.letsencrypt.org/u/_az)\ **Post date:** [December 31, 2017, 6:37am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/4 "2017-12-31T06:37:26Z")
That is not your .htaccess file. Your .htaccess file is an actual file that exists in the same directory as your website. For example, the same directory as `index.php`. You need to put the redirect rule at the top of that file. ---
**Author:** ![Donske](https://avatars.discourse-cdn.com/v4/letter/d/bcef8e/32.png) [@Donske](https://community.letsencrypt.org/u/Donske)\ **Post date:** [December 31, 2017, 6:55am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/5 "2017-12-31T06:55:29Z")
Ok, I had a funny feeling about that file, so I FTP to my root dir and downloaded the .htaccess and opened it and it looks somewhat similar as below: # BEGIN cPanel-generated php ini directives, do not edit # Manual editing of this file may result in unexpected behavior. # To make changes to this file, use the cPanel MultiPHP INI Editor (Home \>\> Software \>\> MultiPHP INI Editor) # For more information, read our documentation ([https://go.cpanel.net/EA4ModifyINI](https://go.cpanel.net/EA4ModifyINI)) php\_flag asp\_tags Off php\_flag display\_errors Off php\_value max\_execution\_time 30 php\_value max\_input\_time 60 php\_value max\_input\_vars 1000 php\_value memory\_limit 128M php\_value post\_max\_size 14M php\_value session.gc\_maxlifetime 1440 php\_value session.save\_path "/var/cpanel/php/sessions/ea-php56" php\_value upload\_max\_filesize 12M php\_flag zlib.output\_compression Off # END cPanel-generated php ini directives, do not edit So, I **added** the code from WNP at the beginning and **finally I had a green padlock** when I just enter [shipsofscale.com](http://shipsofscale.com) - the address bar shifts immediately to show the green padlock ! thank you very much ! RewriteCond %{HTTP\_HOST} [shipsofscale.com](http://shipsofscale.com) [NC] RewriteCond %{SERVER\_PORT} 80 RewriteRule ^(.\*)$ [https://shipsofscale.com/$1](https://shipsofscale.com/%241) [R,L] 🤔 **However** , I have just one small detail left and I run a forum in this root as well and it is [shipsofscale.com/sosforums](http://shipsofscale.com/sosforums) (it is showing non-secure). So, it seems logical I need to add another statement and I am wondering if that “path” also needs to have a rule on it as well: ---
**Author:** ![system](https://global.discourse-cdn.com/letsencrypt/original/3X/c/a/ca6c06ea1ea201324bba7048c6841ce60236468d.png) [@system](https://community.letsencrypt.org/u/system)\ **Post date:** [January 30, 2018, 6:55am UTC](https://community.letsencrypt.org/t/certificates-installed-by-host-passes-test-no-padlock/49267/6 "2018-01-30T06:55:32Z")
Closed on January 30, 2018, 6:55am UTC This topic was automatically closed 30 days after the last reply. New replies are no longer allowed.