Important points to note:
- ZeroSSL EC 256 is the default configuration, you may change this via advanced options when requesting the certificate. We recommend EC 256 for balanced performance and security.
- ZeroSSL does not support RSA 2048 using our TLS Tool
- Your private keys stored in our Client Portal is encrypted with password and salt with Argon2id for key derivation, and then securely encrypted with AES-256-GCM.
- Free subdomains do not need to request a certificate as it is automatically covered.
How to request for a certificate
- Head to the Client Portal TLS section, input your domain and request it.
- Add the required CNAME in the Control Panel, or your respective DNS provider.
- Click on the Validate TLS button.
- Copy and paste the Private Key followed by the Certificate in the Control Panel.
Using other Certificate Authorities
You are not limited to using our TLS Tool with those 3 CAs. If you have a certificate purchased elsewhere, you may input the private key and certificate provided by your CA into our control panel.Do note that:
Spookhost Free webservers are configured to only support TLS 1.2 and TLS 1.3 along with Post-Quantum Cryptography support. If your TLS certificate is correctly installed, you will get a score of A in Qualys SSL Labs. (See https://www.ssllabs.com/ssltest/analyze.html?d=demo.shpage.top&hideResults=on)
- RSA keys are only supported up to 2048 bits, if you need higher security, consider EC keys.
- We highly recommend the use of certificate chains as it ensures browser compatibility especially with new Root CAs recently. To add a certificate chain, simply put them AFTER your website's end entity certificate. We do not recommend including the Root CA.
---BEGIN CERT--- // your website's end entity cert ---END CERT--- ---BEGIN CERT--- // intermediate CAs ---END CERT--- ... and more intermediate CAs
Security of our server's TLS setup
Spookhost Free webservers are configured to only support TLS 1.2 and TLS 1.3 along with Post-Quantum Cryptography support. If your TLS certificate is correctly installed, you will get a score of A in Qualys SSL Labs. (See https://www.ssllabs.com/ssltest/analyze.html?d=demo.shpage.top&hideResults=on)
Spookhost - https://spookhost.xyz/