Using a Free Certificate on DomainFactory

Introduction and Preliminaries

I hope that these instructions help you to get started, but notice that
I AM TAKING NO RESPONSIBILITY FOR ANY DAMAGE THAT MIGHT BE CAUSED.
USE AT YOUR OWN RISK.
For more detailed instructions read the documentation of the tools you are using.

While I wrote these instructions here in English, the admin web pages of DomainFactory (df.eu) are mostly in German. Maybe you can switch some of them to English, but I didn't try.

The page https://certbot.eff.org/hosting_providers claims that df.eu does not support HTTPS. Well, that's not really true. They do offer HTTPS and they offer (paid) certificates from some certificate authority. The procedure is (at least for now) a bit cumbersome, even though you pay for the certificates. So the following instructions might be as easy for you if you have some sysadmin experience.

It is not (or just not easily?) possible to run certbot on the host, at least with our hosting plan. So the idea is to run certbot locally on your own machine and interact manually with the host using cPanel for two steps:

Fulfill the ACME HTTP challenge.
Install the created certificate in cPanel.

(I got an initial procedure by asking Google's AI questions like "how to get a certificate from letsencrypt fulfilling a http challenge manually and install it via cpanel". See also https://eff-certbot.readthedocs.io/en/latest/using.html#manual. There was also some trial and error involved.)

The Procedure

Open cPanel in your browser:

From DomainFactory's "Kundenmenü" (customer menu):
cPanel Webhosting > Login > cPanel-Administration > Tools

On some machine (not the hosting server) do the following:

Install certbot. On my Ubuntu I did it by sudo snap install --classic certbot (certbot requires --classic install. Check if the security implications of that are acceptable for you.)
I had already created files domain.key and account.key according to instructions from https://GetHTTPSForFree.com in an earlier experiment:
```
openssl genrsa 4096 > domain.key
openssl genrsa 4096 > account.key
```
Not sure if they are needed. certbot will complain if they are needed but unavailable.

Now run certbot like this:

certbot certonly --manual --preferred-challenges http -d your.domain.tld --config-dir . --work-dir . --logs-dir .

where you replace your.domain.tld and possibly also the various directories.

Answer certbot's questions. Not sure if it makes sense to provide an email address. Is it used to remind of certificate expiry?
At some point certbot will ask you to fulfill the HTTP challenge by creating a resource in the folder http://your.domain.tld/.well-known/acme-challenge/.
Hints:
- Be sure to use or create the subdirectories .well-known/acme-challenge/ in the appropriate folder for your domain.
- I used cPanel's terminal to create the file. The file manager might have a problem with the leading dot in .well-known.
- Check if the resource is reachable (using HTTP, not HTTPS).
When you're done, let certbot continue. It will create various files and tell you where they are.

In CPanel open the certificate-upload UI:

Tools > Sicherheit (security) > SSL/TLS > section "SSL-Website installieren"
There perform the following steps:
- Select your domain (the one without the trailing ".dummy"!) in the menu.
- Enter the contents of cert.pem in the first textarea.
- Enter the contents of privkey.pem in the second textarea.
- Press button "Automatisch ausfüllen nach Zertifikat" ("fill in automatically according to certificate")
- For me it was not necessary to fill the third textarea (CABUNDLE), but it might be necessary for you, depending on what cPanel already "knows".
- If all went well, press button "Zertifikat installieren".
- Hopefully you get a positive answer here.

In a browser:

Test your certificate by accessing https://your.domain.tld/ in a browser.
You may also check what your browser tells about the page and its certificate. (In Firefox by typing Ctrl-I.)

Notes

I have chosen the HTTP challenge because I knew how to fulfill it without breaking anything else. The DNS challenge could probably be fulfilled using the "Kundenmenü" (customer menu), but I didn't dare to mess with DNS. (Furthermore adding a file to a web site is easier to automate.)
Before using certbot I used http://GetHTTPSForFree.com/. This application asks you to run various commands (mostly invocations of openssl) so that you need not enter any secrets (private keys) into the page. This is even more secure than using certbot since you need not trust certbot not to abuse your secrets. It is also instructive for learning how the ACME protocol works. But it is too cumbersome for regular certificate updates.
I've also tried acme.sh. I hoped that I could tweak it and maybe even install it on the host later to automate the process a bit more. But acme.sh does not support manual fulfillment of an http challenge.
It is possible to pass certbot (the name of) a script fulfilling the challenge. (See https://eff-certbot.readthedocs.io/en/latest/using.html#hooks.) If you have enabled ssh access to the host in cPanel and uploaded and authorized your public key, it should not be too difficult to write such a script using scp.
On the trade-off between a paid certificate from DomainFactory and a free one with certbot:
- The simplest paid certificates are not that expensive: 2.99€/month. (But each payment also causes a little bookkeeping effort.)
- Free certificates are valid for 3 months, paid ones for 6 months.
- Getting a free certificate requires a little admin work, paid ones can be ordered in the "Kundenmenü" (customer menu). It takes a little (e.g., an hour) before the certificate can be downloaded from the Kundenmenü. In the meantime you get several e-mails, some of which are even confusing.
- I hope to streamline the certbot process over time. For paid certificates I would hope that DomainFactory streamlines their process (even including automatic installation of new certificates).
- Installing a certificate is the same procedure in both cases.
By the way, DomainFactory is a hoster based in Munich, Germany. But the actual hosting seems to happen in the western US. (In the summer of 2026 the date command returns a time in the MST zone without daylight saving. So it might be in Arizona.)
Let me know in the comments if it worked for you, what you had to change or add, or where you failed. Maybe this helps others and maybe I can improve the instructions.

hcschuetz/DomainFactory-free-Certificates.md

Select an option