diff --git a/backend/internal/dead-host.js b/backend/internal/dead-host.js
index ee27e53cc5..599ef2392c 100644
--- a/backend/internal/dead-host.js
+++ b/backend/internal/dead-host.js
@@ -46,7 +46,13 @@ const internalDeadHost = {
 
 		// At this point the domains should have been checked
 		data.owner_user_id = access.token.getUserId(1);
-		const thisData = internalHost.cleanSslHstsData(data);
+
+		// Don't clean the ssl_forced/http2_support/hsts_* fields yet if a
+		// certificate is about to be requested. certificate_id has already
+		// been stripped above, so cleanSslHstsData would see "no cert" and
+		// zero out the SSL toggles the user just submitted, even though a
+		// certificate is created moments later in this same request.
+		const thisData = createCertificate ? data : internalHost.cleanSslHstsData(data);
 
 		// Fix for db field not having a default value
 		// for this optional field.
@@ -69,10 +75,16 @@ const internalDeadHost = {
 		if (createCertificate) {
 			const cert = await internalCertificate.createQuickCertificate(access, data);
 
-			// update host with cert id
+			// Update host with cert id and re-apply the originally submitted
+			// SSL toggles, now that a real certificate exists for them to
+			// validate against.
 			await internalDeadHost.update(access, {
 				id: row.id,
 				certificate_id: cert.id,
+				ssl_forced: thisData.ssl_forced,
+				http2_support: thisData.http2_support,
+				hsts_enabled: thisData.hsts_enabled,
+				hsts_subdomains: thisData.hsts_subdomains,
 			});
 		}
 
diff --git a/backend/internal/proxy-host.js b/backend/internal/proxy-host.js
index 2c159d48ad..3275dfd6ab 100644
--- a/backend/internal/proxy-host.js
+++ b/backend/internal/proxy-host.js
@@ -49,7 +49,15 @@ const internalProxyHost = {
 			.then(() => {
 				// At this point the domains should have been checked
 				thisData.owner_user_id = access.token.getUserId(1);
-				thisData = internalHost.cleanSslHstsData(thisData);
+
+				// Don't clean the ssl_forced/http2_support/hsts_* fields yet if a
+				// certificate is about to be requested. certificate_id has already
+				// been stripped above, so cleanSslHstsData would see "no cert" and
+				// zero out the SSL toggles the user just submitted, even though a
+				// certificate is created moments later in this same request.
+				if (!createCertificate) {
+					thisData = internalHost.cleanSslHstsData(thisData);
+				}
 
 				// Fix for db field not having a default value
 				// for this optional field.
@@ -64,10 +72,16 @@ const internalProxyHost = {
 					return internalCertificate
 						.createQuickCertificate(access, thisData)
 						.then((cert) => {
-							// update host with cert id
+							// Update host with cert id and re-apply the originally submitted
+							// SSL toggles, now that a real certificate exists for them to
+							// validate against.
 							return internalProxyHost.update(access, {
 								id: row.id,
 								certificate_id: cert.id,
+								ssl_forced: thisData.ssl_forced,
+								http2_support: thisData.http2_support,
+								hsts_enabled: thisData.hsts_enabled,
+								hsts_subdomains: thisData.hsts_subdomains,
 							});
 						})
 						.then(() => {
diff --git a/backend/internal/redirection-host.js b/backend/internal/redirection-host.js
index 542439fd36..715b61f8c8 100644
--- a/backend/internal/redirection-host.js
+++ b/backend/internal/redirection-host.js
@@ -49,7 +49,15 @@ const internalRedirectionHost = {
 			.then(() => {
 				// At this point the domains should have been checked
 				thisData.owner_user_id = access.token.getUserId(1);
-				thisData = internalHost.cleanSslHstsData(thisData);
+
+				// Don't clean the ssl_forced/http2_support/hsts_* fields yet if a
+				// certificate is about to be requested. certificate_id has already
+				// been stripped above, so cleanSslHstsData would see "no cert" and
+				// zero out the SSL toggles the user just submitted, even though a
+				// certificate is created moments later in this same request.
+				if (!createCertificate) {
+					thisData = internalHost.cleanSslHstsData(thisData);
+				}
 
 				// Fix for db field not having a default value
 				// for this optional field.
@@ -64,10 +72,16 @@ const internalRedirectionHost = {
 					return internalCertificate
 						.createQuickCertificate(access, thisData)
 						.then((cert) => {
-							// update host with cert id
+							// Update host with cert id and re-apply the originally submitted
+							// SSL toggles, now that a real certificate exists for them to
+							// validate against.
 							return internalRedirectionHost.update(access, {
 								id: row.id,
 								certificate_id: cert.id,
+								ssl_forced: thisData.ssl_forced,
+								http2_support: thisData.http2_support,
+								hsts_enabled: thisData.hsts_enabled,
+								hsts_subdomains: thisData.hsts_subdomains,
 							});
 						})
 						.then(() => {