Install a paid SSL certificate in DirectAdmin

DirectAdmin can issue free Let's Encrypt certificates, but when you need an OV, EV or commercial wildcard certificate you install it yourself. The process has three parts: create a key and CSR, paste the issued certificate, and add the CA bundle.

Before you start

• Log in to DirectAdmin as the user who owns the domain.
• Make sure SSL is enabled for the domain: Account Manager → Domain Setup, select the domain and check that Secure SSL is ticked.

Create a key and CSR

1. Go to Account Manager → SSL Certificates (in older skins, Advanced Features → SSL Certificates) and select the domain if you have several.
2. Choose Create A Certificate Request.
3. Fill in the two-letter country code, state, city, company, division, common name (for example www.example.com or *.example.com) and email.
4. Choose a key size of 2048 bits and SHA-256, then click Save.
5. DirectAdmin displays the CSR. Copy it, including the BEGIN and END lines, and submit it to the CA. The private key is stored automatically.

Validate with the CA

Complete validation. For HTTP validation, upload the CA's file with File Manager to domains/example.com/public_html/.well-known/pki-validation/. For DNS validation, add the record in Account Manager → DNS Management.

Install the certificate

1. Return to SSL Certificates for the domain.
2. Choose Paste a pre-generated certificate and key.
3. The text area already contains the private key from your CSR. Paste the certificate from the CA underneath it, so the box contains the key followed by the certificate.
4. Click Save.

Add the CA bundle

1. On the same SSL Certificates page click Click Here to paste a CA Root Certificate.
2. Tick Use a CA Cert.
3. Paste the intermediate certificate(s) from the CA, each with its BEGIN and END lines.
4. Click Save.

Force HTTPS

In Account Manager → Domain Setup select the domain and enable Force SSL with https redirect if available, or use the private_html settings to link it to public_html and add a redirect in .htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

DirectAdmin serves HTTPS from private_html. Most setups make it a symbolic link to public_html so both protocols serve the same files; choose Use a symbolic link from private_html to public_html in Domain Setup if your site appears empty over HTTPS.

Verify

• Open https://example.com and check issuer, names and expiry.
• Use an external SSL checker to confirm the chain is complete.
• Set a reminder well before expiry, because paid certificates are not renewed automatically.

Troubleshooting

• Site over HTTPS shows a different page: private_html is a separate folder; switch to the symbolic link.
• Certificate and key mismatch: the certificate belongs to another CSR; reissue it.
• Let's Encrypt replaces your certificate: disable Let's Encrypt auto-renewal for that domain if you created one earlier.

Next steps

• Free Let's Encrypt SSL in DirectAdmin
• Fix an incomplete chain
• Renew an expiring certificate