An issued certificate does nothing until it is installed on the server that answers for your domain. You need three things:
- The certificate — from the certificate's page in your control panel, or the email the authority sent.
- The private key — on the server where you generated the CSR.
- The intermediate chain (the "CA bundle") — supplied with the certificate. Without it, some browsers and most phones report the certificate as untrusted.
Where to install it
| Server | Where |
|---|---|
| cPanel | Security → SSL/TLS → Manage SSL sites: paste the certificate, the key and the bundle, then Install Certificate |
| Plesk | Websites & Domains → SSL/TLS Certificates: upload all three, then assign the certificate to the site |
| Microsoft IIS | Server Certificates → Complete Certificate Request, then bind it to the site on port 443 |
| Apache | SSLCertificateFile, SSLCertificateKeyFile and SSLCertificateChainFile in the site's config, then reload Apache |
| NGINX | Concatenate the certificate and the chain into one file for ssl_certificate, key in ssl_certificate_key, then reload |
Check it
Open https://yourdomain.com in a private window. The padlock should appear with no warning. Then check it on a phone — a missing intermediate chain often shows up there first.
Then
- Send every visitor to the secure address: Redirect every visitor to HTTPS.
- No dedicated IP needed on shared hosting: SSL without a dedicated IP.
Note
Need the certificate reissued — a new key, a changed name, a lost private key? Open a ticket from the certificate's page and we'll take it through with the authority.