SSL Certificate Installation: Step-by-Step Guide

This guide walks you through installing an SSL certificate purchased from a commercial certificate authority (CA) like DigiCert, GlobalSign, or Sectigo. You’ll learn how to generate a certificate signing request (CSR), submit it to your CA, and then install the issued certificate on your web server. By the end, your website will serve traffic over HTTPS, showing the padlock icon in browsers and encrypting data between your server and visitors.

What You’ll Need

• Access to your web server’s control panel or command line (SSH).
• The private key that was generated alongside your CSR (you’ll need this during installation).
• The SSL certificate file(s) provided by your CA (usually a primary certificate and possibly intermediate certificates).
• Administrative or root privileges on the server.
• If you’re using a shared hosting provider, you may need to use their cPanel or Plesk interface instead of the command line.

Step-by-Step

1. Generate a Certificate Signing Request (CSR) and Private Key – On your server, create a CSR and private key. For Apache/Nginx on Linux, use OpenSSL:

   openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

   Enter your domain name (Common Name) exactly as it appears in the URL (e.g., www.example.com). Keep the private key file secure.

2. Submit the CSR to Your Certificate Authority – Log in to your CA’s website, go to the certificate management section, and paste the contents of your CSR file. Follow their instructions to validate domain ownership (usually via email, DNS record, or HTTP file).
3. Download the Issued Certificate and Intermediate Bundle – After validation, your CA will provide the SSL certificate (often as a .crt file) and a bundle of intermediate certificates. Download both to your server.
4. Combine Your Certificate with Intermediates (if required) – Some servers require a single file containing your certificate followed by the intermediate certificates. Create this by concatenating them:

   cat yourdomain.crt intermediate.crt > yourdomain_fullchain.crt

   If your CA provides a single bundle file, you can skip this step.

5. Install the Certificate on Your Web Server – The exact steps depend on your server software:
   • Apache: Edit your virtual host configuration. Add or update lines like:

     SSLCertificateFile /path/to/yourdomain_fullchain.crt
     SSLCertificateKeyFile /path/to/yourdomain.key

     Then restart Apache with sudo systemctl restart apache2 (or httpd).

   • Nginx: In your server block, add:

     ssl_certificate /path/to/yourdomain_fullchain.crt;
     ssl_certificate_key /path/to/yourdomain.key;

     Then reload Nginx with sudo systemctl reload nginx.

   • cPanel/Plesk: Use the SSL/TLS section, paste your certificate and private key, and select the domain.
   • IIS (Windows): Use the IIS Manager, import the certificate under Server Certificates, then bind it to your site.
6. Test Your Installation – Visit https://yourdomain.com in a browser. You should see a padlock icon. To verify the certificate chain, use an online SSL checker or run:

   openssl s_client -connect yourdomain.com:443

Common Mistakes

• Mismatched Private Key and Certificate – If the private key doesn’t correspond to the certificate, the server won’t start or browsers will show an error. Ensure you’re using the key generated with the CSR.
• Missing Intermediate Certificates – Not including the intermediate bundle can cause “certificate chain incompleteâ€� errors in some browsers.
• Wrong Domain Name – The certificate’s Common Name must match the domain you’re serving. If you’re using www.example.com, the certificate must cover it or you need a wildcard certificate.
• Forgetting to Redirect HTTP to HTTPS – After installation, set up a redirect so visitors using http:// are sent to the secure version.

Tips

• Always back up your private key and certificate files in a secure location.
• Use a certificate with a 2048-bit or higher RSA key for better security.
• Set up automatic renewal if your CA offers it, or add a calendar reminder to renew before expiration.
• Use a tool like ssl-checker online to verify the full chain and expiration date.
• If you’re on a load balancer or CDN, install the certificate on that device as well, not just the origin server.

Troubleshooting

If your site shows errors after installation, try these steps:

• “Certificate not trustedâ€� or “unable to get local issuer certificateâ€� – This usually means intermediate certificates are missing. Re-check that you’ve included the full chain.
• Server won’t start – Check the server error logs. Often this is due to a mismatched key or incorrect file paths. Verify that the private key matches the certificate with:

  openssl x509 -noout -modulus -in yourdomain.crt | openssl md5
  openssl rsa -noout -modulus -in yourdomain.key | openssl md5

  The two outputs should match.

• Certificate works on one browser but not another – This could be a chain issue. Use an online SSL checker to see if the chain is complete and ordered correctly.
• Redirect loop – If you’ve set up a redirect and get an infinite loop, ensure that your HTTPS site isn’t also redirecting to HTTP. Check your configuration files for conflicting rules.

Frequently Asked Questions

How long does it take to get an SSL certificate from a commercial CA?

It depends on the validation level. Domain Validation (DV) certificates can be issued in minutes to a few hours, while Organization Validation (OV) or Extended Validation (EV) can take a few days because they require manual checks.

Can I install the same SSL certificate on multiple servers?

Yes, as long as the certificate covers the domain(s) and you have the private key. You can copy the certificate and key files to each server and install them there.

What is a wildcard certificate and when should I use it?

A wildcard certificate secures a domain and all its subdomains (e.g., *.example.com). Use it if you have many subdomains on the same server or IP.

Do I need a dedicated IP address for SSL?

With modern SNI (Server Name Indication) support, you don’t need a dedicated IP for most browsers. However, some older clients may not support SNI, so a dedicated IP can still be helpful.

What happens if my certificate expires?

Browsers will show a security warning, and visitors may be blocked from accessing your site. You’ll need to renew the certificate and reinstall it before it expires.

Can I convert my certificate to a different format (e.g., PFX for Windows)?

Yes, you can convert using OpenSSL. For example, to create a PFX file from your certificate and key:

openssl pkcs12 -export -out yourdomain.pfx -inkey yourdomain.key -in yourdomain.crt

This is useful for IIS or other Windows-based servers.

Related

• Vivo T4x vs iQOO Z10: Specs Compared
• Belfast vs Derry: Indian Startup Office Choice
• Galaxy A37 vs Redmi Note 17 Pro 5G: Which Fits?