Install a purchased SSL certificate in cPanel

AutoSSL covers most sites for free, but some need a purchased certificate, for example an organisation-validated (OV) or extended-validation (EV) certificate, or one required by a payment partner. Installing it in cPanel takes three steps: create a key and CSR, get the certificate from the authority, and install it with the CA bundle. This guide walks through each step and how to check the result.

Before you start

• A cPanel login for the account that owns the domain.
• The domain pointing at your Linux VPS.
• An order with a certificate authority, ready for a CSR.
• Your organisation details if the certificate is OV or EV: legal name, city, state or region and country code.

Generate a private key and CSR

The CSR (certificate signing request) holds your domain and public key. The private key stays on the server.

1. In cPanel, open Security » SSL/TLS.
2. Under Certificate Signing Requests (CSR), click Generate, view, or delete SSL certificate signing requests.
3. Leave Key set to generate a new 2,048-bit RSA key, unless your authority asks for something else.
4. In Domains, enter the names the certificate must cover, one per line, for example example.com and www.example.com.
5. Fill in city, state, country, company and email. Use exact legal details for OV and EV orders.
6. Click Generate.

cPanel shows the encoded CSR, starting with -----BEGIN CERTIFICATE REQUEST-----. Copy all of it, including the first and last lines, into your certificate order.

The matching private key is saved under Private Keys (KEY) on the SSL/TLS page.

Complete validation with the authority

The certificate authority checks you control the domain, usually by email, a DNS TXT record or a file uploaded to the site. For a DNS check, add the record in cPanel Zone Editor. For a file check, upload it with File Manager to the exact path they give.

When validation is done, the authority sends:

• The certificate (CRT) for your domain.
• The CA bundle (intermediate certificates), sometimes called the chain.

Install the certificate

1. Go back to Security » SSL/TLS.
2. Under Install and Manage SSL for your site (HTTPS), click Manage SSL sites.
3. Choose the domain from the Domain menu.
4. Paste the certificate, from -----BEGIN CERTIFICATE----- to -----END CERTIFICATE-----, into Certificate: (CRT).
5. Click Autofill by Certificate. cPanel finds the matching private key and often fetches the CA bundle automatically.
6. If Certificate Authority Bundle: (CABUNDLE) is still empty, paste the intermediate certificates you received.
7. Click Install Certificate.

cPanel installs the certificate and reloads the web server. A success message lists the domains it covers.

Check it works

Open the site in a browser and view the certificate details. Then check the chain from a terminal:

echo | openssl s_client -connect example.com:443 -servername example.com -showcerts 2>/dev/null | grep -E 's:|i:'

You should see your domain certificate and at least one intermediate, each issued by the next. A single certificate with no intermediate means the CA bundle is missing.

You can also run the domain through an online SSL checker. It should report a complete chain and no warnings.

Troubleshooting

• "The certificate does not match any private key": the CSR was made elsewhere or the key was deleted. Generate a new CSR in cPanel and ask the authority to reissue.
• Works on desktop, fails on some phones: the CA bundle is missing. Reinstall with the intermediates in the CABUNDLE box.
• www shows a warning: the certificate does not include www. Reissue with both names.
• Old certificate still shown: NGINX or a CDN in front is caching it. Rebuild NGINX config or update the CDN, then reload.
• Certificate replaced by AutoSSL: turn off the AutoSSL option that replaces non-AutoSSL certificates and reinstall.

Next steps

• Redirect all visitors to HTTPS: force HTTPS for a domain in cPanel.
• Prefer free certificates for other sites: set up AutoSSL in cPanel & WHM.