May 2023

How to Install an SSL/TLS Certificate In cPanel 11.x The following instructions will guide you through the SSL installation process on cPanel (Paper-Lantern Theme Modern). If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our CSR Generation Instructions and disregard the steps below. What You’ll Need Your server certificate This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order. Your intermediate certificates These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate. Your private key This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it. Installation Instructions Log in to cPanel The first step is to login to your cPanel account, this can typically be accessed by going to https://domain.com:2083 Note: You may encounter an error message “Your connection is not private” or something similar when attempting to visit your cPanel login page. This is caused due to your login page using a self-signed certificate by default. Please disregard this and proceed past the error message. After navigating to your cPanel login page, enter your Username/Password and click Log in. Your cPanel Homepage should look like this: Note: Older versions such as X3 Theme-Classic may not look like the image above, but should still contain the same concept and category structure. Navigate to the SSL/TLS Manager You can access your SSL/TLS Manager page by scrolling down to the Security section and selecting the SSL/TLS button. Note: You can also navigate to the SSL/TLS Manager page by utilizing the Search Feature at the top right of the cPanel home page and searching for “SSL”.  Select “Manage SSL Sites” Your SSL/TLS Manager page will allow you to manage everything related to SSL/TLS configuration for cPanel. The “Manage SSL Sites” Hyperlink is located underneath “Install and Manage SSL for your site (HTTPS)” shown below. Select your domain Change the Domain drop-down to the appropriate domain name that you want to install your SSL certificate on. Copy and paste your certificate files Once you have your domain selected, you just need to copy and paste your individual certificate files into the appropriate text box(s) pictured below. Certificate (CRT) – This is your server certificate that was issued to your domain(s). Note 1:cPanel should automatically fetch the Certificate (CRT) text if you previously uploaded the server certificate in the “Generate, view, upload or delete SSL certificate” section of your SSL/TLS Manager and selected the correct domain name above in the dropdown. Note 2: If you received the certificate in a ZIP file, click “Extract All” and then drag your server certificate into a text editor such as Notepad. This will allow you to copy all text contents needed including “—–BEGIN CERTIFICATE—–” and “END CERTIFICATE—–“. Private Key (KEY)– This is your private key that was created during the generation process. Note 1: cPanel should automatically fetch the Private Key (Key) text if you previously created the Certificate Signing Request (CSR) in the “Generate, view, or delete SSL certificate signing requests” section of your SSL/TLS Manager and selected the correct domain name above in the dropdown. Note 2: If you made the CSR and private key outside of your cPanel account and failed to save the files, you will have problems proceeding and may need to re-issue the SSL certificate with a newly created key pair. Certificate Authority Bundle (CABundle) – This is your intermediate certificates that allow browsers and devices to understand who issued your trusted certificate. Note 1:cPanel should automatically fetch the CA Bundle from a public repository. If not, download the appropriate CA Bundle for your certificate. Note 2: If you have multiple intermediate certificates, paste each of them one after another to create the correct certificate chain/path. Click “Install Certificate” Once you have the correct certificate files in the appropriate text boxes, simply click the blue “Install Certificate” button. Congratulations! You’ve successfully installed your SSL certificate! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect. Note 1: You are not required to “Enable SNI for Mail Services.” Server Name Indication (SNI) should only be used if multiple hostnames are being served over HTTPS from the same IP address. Note 2: You or your web host may need to restart the Apache server before the certificate will work. To check your server’s configurations more thoroughly, use our SSL Checker Tool or contact our Customer Experience Department for additional assistance. Manual Intermediate Installation Instructions If the intermediate certificates did NOT get successfully installed and configured after completing the above instructions, please reference the instructions below on how to manually install them directly in Apache. If you do not have access to your Apache server, please contact your web host or system administrator for additional assistance. Locate the Virtual Host File The Virtual Host File , this can typically be accessed in the /etc/httpd/conf/httpd.conf file. Note: The location and name of this file can change from server to server depending on your configuration. Another popular name for the file is “SSL.conf”. View the Virtual Host File View the Virtual Host configuration with the proper name & IP address (including port 443). Edit the Virtual Host File Edit your Virtual Host configuration by adding the bolded YourIntermediateCertificate file below: <VirtualHost 192.168.255.255:443> DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile  /path/to/YourIntermediateCertificate.crt </VirtualHost> Note: Make sure you type the correct file path and name where you plan on saving the intermediate

How to Install an SSL/TLS Certificate In Citrix Secure Server The following instructions will guide you through the SSL installation process on Citrix Secure Server. If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our CSR Generation Instructions and disregard the steps below. What You’ll Need Your server certificate This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order. 2.Your intermediate certificates These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate. Your private key This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it. Installation Instructions Determine your Microsoft IIS version Different versions of Microsoft IIS have varying steps for completing SSL installations. Please reference the table below if you do not know what version of IIS you are running: Your Operating System IIS Version Windows Server 2003 6 Windows Vista and Windows Server 2008 7 Windows 7 and Windows Server 2008 R2 7.5 Windows 8 and Windows Server 2012 8 Source: https://support.microsoft.com/en-us/kb/224609 Select the appropriate instructions Upon determining what version of IIS you are running, select the appropriate set of SSL Installation Instructions below: Microsoft IIS 6.x Microsoft IIS 7.x Microsoft IIS 8.x The reference instructions above will help you successfully install the SSL certificate. Afterwards, check your work by visiting the website in your browser at https://yourdomain.tldhttps://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.  

How to Install an SSL/TLS Certificate In Apache Open SSL The following instructions will guide you through the SSL installation process on Apache OpenSSL. If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our CSR Generation Instructions before following the steps below. What You’ll Need Your server certificate This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order. Your intermediate certificates These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate. Your private key This file should be on your server, or in your possession if you generated your CSR from a free generator tool. On certain platforms, such as Microsoft IIS, the private key is not immediately visible to you but the server is keeping track of it. Note: The above files should be saved to the server directory where all certificate/key files are stored. Installation Instructions Locate the apache config file to edit The main config file is typically called httpd.conf or apache2.conf and located via /etc/httpd or /etc/apache2/. Note: The SSL config file can be in a <VirtualHost> block in another config file. You can always search for the SSL conf file on Linux distributions using this grep command: grep -i -r “SSLCertificateFile” /etc/httpd/ Configure the file and enter commands Configure the httpd.conf file and enter the following commands on your VirtualHost to successfully enable SSL: <VirtualHost 192.168.0.1:443> DocumentRoot /var/www/html2 ServerName www.yourdomain.com SSLEngine on SSLCertificateFile /path/to/your_domain_name.crt SSLCertificateKeyFile /path/to/your_private.key SSLCertificateChainFile /path/to/cabundle.crt </VirtualHost> Note: If you need the site to load via https and http, create another virtual host for http. You can simply copy the existing config file before making any during this step. Run a command test Test your new config file by running the following command:apachectl configtest Restart Apache If successfully tested, restart Apache by running the following commands:apachectl stop apachectl start Note: You may be asked to enter the password you generated with your RSA key. If you do not want to be asked for a password, you will need to re-generate your RSA key file. Congratulations! You’ve successfully installed your SSL certificate! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.  

How to Install an SSL/TLS Certificate In Amazon EC2 (AWS) The following instructions will guide you through the SSL installation process on Amazon EC2 Server (AWS). If you have more than one server or device, you will need to install the certificate on each server or device you need to secure. If you still have not generated your certificate and completed the validation process, reference our Amazon EC2 Server CSR Generation Instructions before going through the steps below. What You Need Your server certificate This is the certificate you received from the CA for your domain. You may have been sent this via email. If not, you can download it by visiting your Account Dashboard and clicking on your order. Your intermediate certificates These files allow the devices connecting to your server to identify the issuing CA. There may be more than one of these certificates. If you got your certificate in a ZIP folder, it should also contain the Intermediate certificate(s), which is sometimes referred to as a CA Bundle. If not, download the appropriate CA Bundle for your certificate. Your private key This file should be on your server, or in your possession if you generated your CSR from a free generator tool. Connect to your EC2 Instance For instructions on how to connect to your instance, check Amazon’s guide here. Save Certificates to EC2 Certificate Directory Navigate to the /etc/pki/tls/certs directory and save the server certificate and CA intermediate certificate files here. The simplest way to upload the certificate into the directory is to open each certificate in a text editor, like Notepad, on your local computer. Then, open Notepad on your EC2 instance, and copy and paste the contents of each certificate to the EC2 Notepad. This method requires root [sudo] permissions. Check File Permission Settings Use the following commands to check that the server certificate file ownership, group, and permission settings match Amazon Linux 2 defaults (owner=root, group=root, read/write for owner only). [ec2-user certs]$ sudo chown root:root custom.crt [ec2-user certs]$ sudo chmod 600 custom.crt [ec2-user certs]$ ls -al custom.crt These commands should yield this result: -rw——- root root custom.crt You should also check the intermediate certificate file permissions, which are less strict. Run these commands: [ec2-user certs]$ sudo chown root:root intermediate.crt [ec2-user certs]$ sudo chmod 644 intermediate.crt [ec2-user certs]$ ls -al intermediate.crt These commands should yield this result: -rw-r–r– root root intermediate.crt Place Private Key in Private Key Directory Navigate to your Private Key directory at /etc/pki/tls/private/. If the key is not already saved there, follow the same steps as when you copied over the contents of your certificate files to save the Private Key in this directory. You may need to copy and paste the key contents between a Notepad on your local computer and another Notepad open on EC2. Again, check the file permissions for the private key with the following commands: [ec2-user private]$ sudo chown root:root custom.key [ec2-user private]$ sudo chmod 600 custom.key [ec2-user private]$ ls -al custom.key These commands should yield this result: -rw——- root root custom.key Edit Configuration File Your certificate configuration file should be located in /etc/httpd/conf.d/ssl.conf. Provide the path and file name of the server certificate (named custom.crtin this example) in Apache’s SSLCertificateFiledirective: SSLCertificateFile /etc/pki/tls/certs/custom.crt Provide the path and file name to the intermediate CA Certificate (named intermediate.crtin this example) in Apache’s SSLCACertificateFile directive: SSLCACertificateFile /etc/pki/tls/certs/intermediate.crt Provide the path and file name of the private key (Named custom.keyin this example) in Apache’s SSLCertificateKeyFiledirective: SSLCertificateKeyFile /etc/pki/tls/private/custom.key Save the configuration file to /etc/httpd/conf.d/ssl.conf. Restart Apache with this command: [ec2-user ~]$ sudo systemctl restart httpd Test the installation by navigating to your domain using the HTTPS:// protocol prefix. If the SSL is successfully installed, you should be able to load the page securely over HTTPS and confirm the standard SSL padlock indicator is visible. Congratulations! You’ve successfully installed your SSL certificate! To check your work, visit the website in your browser at https://yourdomain.tld and view the certificate/site information to see if HTTPS/SSL is working properly. Remember, you may need to restart your server for changes to take effect.