A "Not Secure" label beside your web address costs you visitors before they read a single word, and plenty of older Kenyan business sites still carry one. A free SSL certificate in Kenya fixes it in roughly five minutes, and SiteBoma applies it for you on every site we host. Below you will find what SSL does, why Google gives HTTPS sites a ranking boost, and how to get the padlock.
SSL and HTTPS in plain terms
SSL stands for Secure Sockets Layer. Strictly speaking the current protocol is TLS, though nearly everyone still calls it SSL. It is the encryption that turns http:// into https://. Once it is in place, everything travelling between a visitor's browser and your site is encrypted end to end: passwords, contact form entries, M-Pesa STK push requests, card numbers. No one sitting between the two machines can read it.
Take SSL away and the visitor's ISP, the café Wi-Fi router they are connected to, or anyone running a packet capture can read every byte sent to you. Passwords included.
Why this matters for Kenyan websites
There are three practical reasons.
1. Browsers warn your visitors in public
Safari, Edge, Firefox and Chrome all put a clear "Not Secure" label in the address bar of any HTTP site, and show a full-screen warning when someone submits a form on one. Picture a customer typing their phone number into your enquiry form when Chrome breaks in with "Attackers may be trying to steal your information." That customer is gone.
2. HTTPS helps you rank on Google
Back in 2014 Google said publicly that HTTPS counts as a positive ranking signal. It is not the heaviest factor, but when three other Kenyan businesses are chasing the same Nairobi search term, small signals add up. Some Kenyan hosts charge KSh 5,000 or more a year for SSL; SiteBoma includes it free on every plan. There is no reason to give away ranking for something that costs you nothing.
3. Online payments depend on it
Safaricom's Daraja API and the payment gateways that take cards and M-Pesa all expect an HTTPS callback URL. Without SSL you cannot take payments online at all.
What does SSL cost in Kenya?
You have two options:
- Let's Encrypt, free: KSh 0. Issued in less than a minute, with automatic renewal every 90 days. The encryption is as strong as on a paid certificate (TLS 1.3, 2048-bit RSA or ECDSA). For 99 percent of Kenyan websites, this is the right pick.
- Paid Extended Validation (EV) SSL: KSh 5,000 to 25,000 a year. Your verified company name is displayed by the browser in the address bar. Banks, big online retailers and government sites use these where extra legal verification is needed. A typical SME does not need one.
For an ordinary business, school, NGO, blog or freelance portfolio in Kenya, a free Let's Encrypt certificate looks no different to visitors. They see the same green padlock.
How SSL gets onto a SiteBoma site
On SiteBoma hosting, SSL is completely automatic, and you genuinely have nothing to do. Behind the scenes:
- You point your domain at SiteBoma, or register a new domain with us.
- DNS propagates, which for .co.ke usually takes less than 15 minutes.
- Our DirectAdmin server spots that the domain now points to us and requests a Let's Encrypt certificate on its own.
- Within 5 to 10 minutes the certificate is issued and installed.
- https://yourdomain.co.ke now loads with the padlock.
- The system renews the certificate automatically every 60 days, without you ever noticing.
Hosted with someone else?
The steps vary by control panel:
- DirectAdmin: "SSL Certificates" → "Free & automatic certificate from Let's Encrypt."
- cPanel: find "SSL/TLS Status" or "AutoSSL", then click "Run AutoSSL."
- Plesk: "SSL/TLS Certificates" → "Install" → "Let's Encrypt."
- VPS or bare Linux server: connect over SSH, install certbot and run
certbot --apacheorcertbot --nginx.
A host that charges for SSL, or does not support Let's Encrypt, is telling you it is time to leave. Free SSL is a standard part of modern hosting, not an extra.
Once the certificate is in: send all HTTP traffic to HTTPS
Installing the certificate is only half the job. Older links pointing at http://yourdomain.co.ke still open the unencrypted version, so you need to redirect every HTTP request to HTTPS. In most cases that means adding a short rule to your .htaccess file:
RewriteEngine On
RewriteCond %{HTTPS} !on
RewriteRule ^(.*)$ https://%{HTTP_HOST}/$1 [R=301,L]On SiteBoma, switching on "Force HTTPS" in DirectAdmin does this for you, and it is often enabled by default already.
Fixing common SSL problems
The browser says "Your connection is not private"
Normally this means the certificate has expired, belongs to a different domain, or the visitor arrived during the short gap before the certificate was issued. If the message is still there 30 minutes after setup, get in touch with support.
"Mixed content" warnings
Your page is pulling in images, scripts or stylesheets over http:// rather than https://. To fix it, use full https:// URLs or protocol-relative ones (//example.com/image.jpg) throughout your HTML. WordPress users can install the free "Really Simple SSL" plugin, which corrects all of this automatically.
A yellow warning sits on the padlock
This is mixed content again: one or more resources still load over HTTP. Press F12, open the Console tab, and the browser lists the URLs responsible.
Does SSL make a site slower?
No, if anything the reverse. With TLS 1.3 the added overhead is in the single-digit milliseconds. Major browsers also only use HTTP/2 and HTTP/3 over HTTPS, and both are significantly faster than HTTP/1.1. Moving an old, sluggish site from HTTP to HTTPS can actually speed it up.
SSL questions answered
Does every subdomain need its own certificate?
Yes, though Let's Encrypt issues one for each subdomain automatically. Alternatively, a wildcard certificate (*.yourdomain.co.ke) covers every subdomain in one go. SiteBoma supports both approaches.
Is my email encrypted too?
Yes. Mail connections (SMTP and IMAP) use the same certificate, so when Outlook or Gmail collects mail from mail.yourdomain.co.ke, that link is encrypted with it.
Should I keep a backup of the certificate?
No need. Let's Encrypt issues a fresh certificate every 60 days, so anything you might back up would be regenerated anyway.
Does WordPress work with SSL?
Fully. Go to Settings → General and change both "WordPress Address" and "Site Address" so they begin with https://. Most managed WordPress hosts handle this step for you.
Get your padlock
Free Let's Encrypt SSL that renews itself is part of every SiteBoma hosting plan. Pay by M-Pesa and your site can be live on HTTPS within 15 minutes.
Already hosting with us and want to check your SSL? In your client dashboard, go to Domains → SSL Status. If anything shows yellow, our team will fix it at no cost.