Installing an SSL certificate in cPanel is a straightforward process once you understand the sequence:
- Generate a certificate signing request (CSR)
- Complete validation and obtain the certificate from GeoTrust
- Install the certificate through the SSL/TLS tools in cPanel.
When everything is configured, your site will load over HTTPS, and your visitors’ data will be protected in transit.
Step 1: Generate a Certificate Signing Request
Before you can install an SSL certificate, you’ll need to create a CSR in cPanel.
- Log in to your cPanel account and navigate to the Security section.
- Click on the SSL/TLS icon to access the certificate management tools.
- Look for the Certificate Signing Requests (CSR) option and click on it to generate a new request.
- You’ll see a form requesting information about your organization and domain. Fill in the details carefully, paying special attention to the Domain field; this should be match the domain you want to secure, such as www.example.com.
- Select 2048 bits for the key size to ensure adequate security.
When you click Generate, cPanel creates both your CSR and a matching private key. The private key is automatically stored on the server for later use. Copy the entire CSR text block, including the —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—– tags, and submit it to GeoTrust.
You’ll then need to complete the validation process for your certificate type.
Step 2: Receive and Prepare Your Certificate Files
After completing validation, you’ll receive your SSL certificate files from GeoTrust. You should receive at least two files: your primary domain certificate (usually a .crt file) and an intermediate certificate bundle (CA bundle).
Download these files to your computer and keep them in an accessible location. The CA bundle is particularly important; it contains the chain of trust that prevents browser warnings on various devices and platforms.
Step 3: Upload Your Certificate to cPanel
Return to the SSL/TLS section in cPanel and locate Generate, view, upload, or delete SSL certificates (CRT) under the Certificates section. In the Upload a New Certificate area, you can either paste the certificate content directly into the text box or use the Browse button to upload your .crt file.
Make sure to include the entire certificate, including the —–BEGIN CERTIFICATE—– and —–END CERTIFICATE—– lines. Click Upload Certificate to save it to the server. Keep your CA bundle file ready for the next step.
Step 4: Install the Certificate on Your Domain
From the SSL/TLS main page, click Manage SSL Sites under the Install and Manage SSL for your site (HTTPS) section. Select your domain from the dropdown menu and click Autofill by Domain, if this option is available. cPanel will attempt to automatically populate the certificate and private key fields.
If autofill doesn’t work, you’ll need to manually paste the information into three fields:
- Certificate (CRT): Your primary domain certificate
- Private Key (KEY): The private key generated with your CSR
- Certificate Authority Bundle (CABUNDLE): Your intermediate certificates
To retrieve your private key, return to the SSL/TLS main page and click Generate, view, upload, or delete your private keys (KEY) under the Private Keys section. You’ll see a list of private keys stored on the server.
- Find the one that corresponds to your CSR (it should have a description matching your domain name or the date you created the CSR).
- Click View or the key name to display the private key text, then copy the entire content, including the —–BEGIN PRIVATE KEY—– and —–END PRIVATE KEY—– tags.
- Double-check that all fields are correctly filled. The CA Bundle field is crucial; omitting it can cause “untrusted certificate” warnings on mobile devices and some browsers.
- Click Install Certificate when ready, and cPanel will activate SSL for your domain.
Step 5: Verify Your Installation
Open a web browser and visit the secure version of your site by adding https:// at the beginning of your domain name. You should see a padlock icon indicating a secure connection. Click the padlock to view the certificate details and confirm everything is correct.
To ensure all traffic uses HTTPS, you may need to set up a redirect from HTTP to HTTPS. This can be done through your .htaccess file or within your application settings. Also, check your website for mixed content warnings by ensuring all internal resources (images, scripts, stylesheets) load via HTTPS.
Troubleshooting Common Issues
If cPanel reports that it cannot find the matching private key, verify that you’re using the same server where the CSR was generated. You cannot use a private key from a different server. If you’ve lost the original private key, you’ll need to generate a new CSR and reissue your certificate.
For certificate chain-related errors, ensure your CA Bundle includes all intermediate certificates in the proper order. If your site shows as secure in some browsers but not others, the CA Bundle is likely incomplete or missing.
If the Autofill feature fails to populate the certificate fields, manually copy and paste each component, ensuring there are no extra spaces or line breaks before or after the certificate text.