Ordering an SSL certificate is one thing; installing it correctly is another. This guide follows the complete path, from the order to the HTTPS redirect, both on cPanel hosting and on a server you administer yourself.
Ordering the right certificate
First decide the coverage (one name, several names or wildcard) and the validation level. On cPanel hosting a Let's Encrypt certificate is already issued automatically: there is nothing to generate to activate it. For a paid certificate, the order is placed from the product page; the configuration step asks for the certificate signing request (CSR) and the exact name to protect.
The name must be a full hostname: example.com and www.example.com are two distinct names unless the certificate covers both. For a wildcard, the request is for *.example.com, which covers every subdomain at one level but not the apex.
Generating the certificate signing request (CSR)
The CSR contains the name to protect and your public key; it does not contain the private key. Generate it on the server that will host the site:
openssl req -new -newkey rsa:2048 -nodes \ -keyout /root/example.key -out /root/example.csr cat /root/example.csr
Paste the content of example.csr into the order form, without the header lines. Keep example.key on the server and never share it: only the CSR is meant for the certificate authority. On renewal or reinstallation a new CSR is usually required.
Validating the domain
- DV validation: by email to a standard domain address, by a DNS record supplied by the authority, or by a file placed on the website.
- OV validation: verification of the organisation's legal existence, with documents if needed.
- EV validation: stronger checks, covering both the organisation and the requester.
Answer the authority's requests precisely: incomplete validation is the first cause of a blocked order. The delay ranges from a few minutes for DV to a few days for EV.
Installing the certificate
On cPanel, open SSL management and then the certificate installation option: paste the certificate, the intermediate chain supplied by the authority and the private key, then install. On an nginx server, declare the files in the site block:
ssl_certificate /etc/ssl/example.crt; ssl_certificate_key /etc/ssl/example.key;
The intermediate chain must be included in the certificate file, otherwise some clients see an incomplete chain. After any change, test the configuration and only then reload the service.
Forcing the HTTPS redirect
Once the certificate is active, redirect HTTP traffic to HTTPS. On cPanel, enable the domain's forced redirect option. On a server, add a rule to the site configuration file:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
Then check that no resource on the site is still loaded over HTTP, otherwise the browser reports mixed content despite the padlock.
Checking the result
- The padlock appears and the certificate shows the right name.
- The expiry date and issuer match the order.
- The HTTPS version of the site loads images, scripts and stylesheets.
- The certificate is identical on the domain and on www, if both are used.
