Install a paid SSL certificate in Plesk

Plesk's SSL It! extension gives free Let's Encrypt certificates, but sometimes you need a paid certificate: OV or EV validation, a specific CA or a wildcard from a commercial provider. This guide covers ordering with a CSR, uploading the files and activating the certificate for a domain.

Before you start

• Access to Plesk with permission to manage the domain's hosting settings.
• A certificate order with a CA, or the plan to create one.

Create a CSR in Plesk

1. Go to Websites & Domains and select the domain.
2. Open SSL/TLS Certificates. In newer Plesk versions this screen is part of SSL It!; scroll to the section for managing certificates or use Manage / Advanced settings.
3. Click Add SSL/TLS Certificate.
4. Enter a certificate name such as example.com OV 2026, choose the key size (2048 bits is standard) and fill in country, state, city, organisation, email and the domain name.
5. Click Request. Plesk creates the private key and the CSR and stores them in the certificate entry.
6. Open the new entry, copy the CSR text including the BEGIN and END lines and submit it to the CA.

For a wildcard certificate enter *.example.com as the domain name.

Validate and download

Complete the CA's validation (email, file or DNS). For DNS validation, add the record in Websites & Domains → DNS Settings if Plesk manages your DNS. When the certificate is issued, download the certificate file and the CA bundle (intermediate certificates).

Upload the certificate

1. Return to the domain's SSL/TLS Certificates screen and open the certificate entry you created.
2. Under Upload the certificate files, choose the certificate file for Certificate (*.crt) and the bundle for CA certificate (*-ca.crt). The private key is already stored.
3. Alternatively, use Upload the certificate as text and paste both.
4. Click Upload Certificate.

If you generated the CSR elsewhere, upload the private key at the same time in the key field.

Assign it to the domain

1. Go to Websites & Domains → domain → Hosting Settings (or Hosting & DNS → Hosting).
2. Under Security, make sure SSL/TLS support is ticked.
3. Select your new certificate in the Certificate drop-down.
4. Tick Permanent SEO-safe 301 redirect from HTTP to HTTPS.
5. Click OK or Apply.

Verify

• Open the site over https:// and check the certificate details: issuer, names and expiry.
• Test with an external SSL checker to confirm the chain is complete.
• Make sure SSL It! does not automatically replace the certificate: in the SSL It! screen, check that the paid certificate is selected and auto-renewal of a Let's Encrypt certificate is not set to take over.

Troubleshooting

• "The private key does not match the certificate": upload into the entry that holds the key used for the CSR.
• Browser warns about an untrusted issuer: the CA bundle is missing; upload it.
• Old Let's Encrypt certificate still shown: the domain's hosting settings still point to it. Select the new certificate.
• Mail clients warn: the mail server uses its own certificate. Use the server hostname for mail, or secure mail separately in Plesk's mail settings.

Next steps

• Free Let's Encrypt certificates with SSL It!
• Fix an incomplete certificate chain
• Fix mixed content warnings