What SSL certificates does Hetzner offer?
An SSL certificate lets you visit your website securely over HTTPS. The certificate must cover your domain name, either directly or through a wildcard certificate. Use the SSL Manager in konsoleH to manage SSL certificates for the domains in your hosting account.
Hetzner offers the following certificate types:
| Certificate Type | Certification Authority | Cost | Validation |
|---|---|---|---|
| Basic Certificate | DigiCert | Free | Domain |
| Let’s Encrypt Certificate | Internet Security Research Group (ISRG) | Free | Domain |
| Business Certificate | Thawte | Fee required | Domain, Address, or Extended Validation |
You can also import certificates from other providers in the SSL Manager.
The following guides describe how to work with SSL certificates in konsoleH:
- Request a Basic or Let's Encrypt Certificate
- Order a Business Certificate
- Import a Third-Party Certificate
- Manage certificates in the SSL Manager
How long are Basic and Let’s Encrypt certificates valid?
Let’s Encrypt certificates are valid for three months. As of March 15, 2026, newly issued SSL certificates from all public certificate authorities are valid for a maximum of 200 days.
The CA/Browser Forum, a group of certificate authorities and browser makers, sets this global limit, not Hetzner.
This limit also applies to Basic certificates. You can find the current validity periods on the page Shortening of Certificate Validity Period.
Hetzner automatically renews Basic and Let’s Encrypt certificates as long as your hosting account remains active.
What restrictions apply to Basic and Let’s Encrypt certificates?
Hetzner’s Basic and Let’s Encrypt certificates work only with Hetzner products. You cannot use them with other hosting providers. Beyond that, there are no technical restrictions.
The certification authority may refuse to issue Basic or Let’s Encrypt certificates for some domain names—for example, for trademark reasons. Hetzner cannot control which domain names are affected. If your domain is affected, you will see a notification when you apply. In this case, order a Business Certificate.
Basic and Let’s Encrypt certificates only confirm control over the domain. They do not contain any information about you or your company. For online stores, Hetzner therefore recommends an address-validated Business Certificate. An address-validated certificate includes the name and registered office of your company.
How do Business Certificates differ?
Business Certificates from Thawte differ in their validation type and the number of domains covered. The following table shows the three validation types.
| Validation Type | What the Certification Authority Verifies | What the Certificate Contains |
|---|---|---|
| Domain-Validated | The certification authority checks that you control the domain through DNS, a file, or email. | Domain name |
| Address-Validated | The certification authority checks that you control the domain and verifies your company's identity, usually by using a business register extract and a phone call. | Domain name, company name, and registered office |
| Extended Validation | Verifies the domain and the company’s identity according to stricter requirements | Domain name and verified identity |
You can view the identity from an address-validated certificate or an Extended Validation certificate in the browser’s certificate details.
A Business certificate covers one or more specific domain names, such as example.com and www.example.com. A certificate for multiple domain names is called a SAN certificate, named after the Subject Alternative Name field in the certificate. You can get SAN certificates as domain-validated or address-validated certificates.
A wildcard certificate covers all subdomains directly under a domain, such as *.example.com.
Business certificates do not renew automatically. You must always renew or reissue them manually in the SSL Manager:
- Renewal: A renewal is a new, paid order. You must confirm the cost again during this process.
- Reissuance: You get new certificate files. The web server uses the new certificate only after you activate it.
To learn how to renew and reissue Business certificates, see Manage Certificates in the SSL Manager.
What support is available for SSL certificates?
Hetzner does not offer phone support for setting up, requesting, or troubleshooting SSL certificates. You can only get help by submitting an authorized support request in konsoleH. A support request lets you fully document domains, DNS entries, and certificate status.
Open the support request in konsoleH under Management → Support Request. There, select the affected hosting account and the topic SSL. In the request, specify the affected domain and the affected certificate.
The SSL Guide answers many questions about setup.