SSL certificate installation

From Zero to Secure: Mastering SSL Certificate Installation

/in /by

Why SSL Certificate Installation Protects Your Business and Customers

SSL certificate installation is the process of adding a security layer to your website that encrypts data traveling between your server and your visitors’ browsers. Without it, sensitive information like logins and payment details are sent as plain text, vulnerable to interception by hackers. Modern browsers flag non-HTTPS sites as “Not Secure,” which can deter visitors, and Google uses HTTPS as a positive ranking signal.

For any business site, the encryption provided by a properly installed SSL certificate is essential for protecting customer data and building trust. The basic process involves these key steps:

  1. Obtain a certificate: Purchase or get a free certificate from a Certificate Authority (CA).
  2. Generate a CSR: Create a Certificate Signing Request with your domain information.
  3. Validate your domain: Prove ownership of the domain to the CA.
  4. Upload certificate files: Move the certificate, private key, and CA bundle to your server.
  5. Configure your web server: Update your server settings to use the new certificate.
  6. Restart your server: Apply the changes.
  7. Force HTTPS: Redirect all HTTP traffic to the secure HTTPS version of your site.

I’m Kevin Gallagher, founder of wpONcall. With over fifteen years of experience in web design and maintenance, I’ve installed SSL certificates on hundreds of WordPress sites. I know that proper SSL implementation is critical for securing data and converting visitors into customers.

SSL certificate installation helpful reading:

Step 1: Obtaining Your SSL Certificate

Before you can begin the SSL certificate installation, you first need to acquire a certificate. This involves choosing the right type for your needs and completing a validation process.

Choosing the Right Certificate for Your Needs

An SSL certificate is a digital file that encrypts communications between your site and its visitors while also validating your server’s identity. Choosing the right one is key for building trust.

Here are the main types:

  • Self-Signed Certificates: These are generated by you, not a trusted Certificate Authority (CA). While they provide encryption, browsers do not trust them, resulting in security warnings for your visitors. They should only be used for internal testing.
  • Certificates from a Certificate Authority (CA): Issued by trusted organizations, these are the standard for public websites.
    • Domain Validation (DV): The most common type. The CA only verifies that you control the domain. DV certificates are fast to issue, often free (like those from Let’s Encrypt), and suitable for most blogs and small business sites.
    • Organization Validation (OV): The CA verifies your organization’s legitimacy in addition to domain control, providing a higher level of trust for visitors.
    • Extended Validation (EV): This offers the highest level of trust, requiring extensive verification of your business’s legal and physical existence. It’s ideal for e-commerce and financial sites where maximum trust is critical.
  • Wildcard Certificates: These secure a primary domain and all of its subdomains (e.g., blog.example.com, shop.example.com) with a single certificate. Many CAs, including Let’s Encrypt, offer wildcard options.
  • Multi-Domain (SAN/UCC) Certificates: These secure multiple different domain names (e.g., example.com, example.net) with one certificate.

For most WordPress sites, a free DV certificate from Let’s Encrypt is an excellent starting point. These expire every 90 days, so an automated renewal process is essential.

Generating a Certificate Signing Request (CSR)

A Certificate Signing Request (CSR) is an encoded block of text containing your domain and organization details, used to apply for your SSL certificate. When you generate a CSR, a corresponding private key is also created on your server. This private key is secret and must be kept secure, as it’s used to decrypt the data secured by your certificate.

The CSR includes:

  • Common Name (CN): Your domain name (e.g., www.example.com).
  • Organization (O): Your organization’s legal name.
  • Organizational Unit (OU): Your department (optional).
  • City/Locality (L): Your city.
  • State/Province (S): Your state.
  • Country (C): Your two-letter country code.

You can typically generate a CSR through your hosting control panel (like cPanel) or using command-line tools like OpenSSL. You will then provide the generated CSR text block to your chosen Certificate Authority.

Example of a Certificate Signing Request (CSR) text block - SSL certificate installation

Completing Domain Validation

After submitting your CSR, the CA must verify that you control the domain. This critical certificate validation process prevents malicious impersonation. Common validation methods include:

  • Email Validation: The CA sends a confirmation email to an address associated with your domain (e.g., admin@example.com).
  • DNS Record Validation: You add a specific TXT record to your domain’s DNS settings.
  • HTTP File Validation: You upload a file provided by the CA to a specific directory on your website.

Once validation is complete, the CA will issue your certificate files. You will typically receive:

  • Your primary certificate (.crt): For your specific domain.
  • Your private key (.key): The secret key you generated with the CSR.
  • The CA bundle: Intermediate certificates that link your certificate to the CA’s trusted root.

With these files, you are ready to install the SSL certificate on your server.

Step 2: The Manual SSL Certificate Installation Process

With your certificate files ready, it’s time for the manual SSL certificate installation. This involves uploading the files to your server and configuring your web server software to use them.

Uploading Certificate Files to Your Server

First, transfer your certificate files—the primary certificate (.crt), CA bundle, and private key (.key)—to your web server. You can use tools like an SFTP client (e.g., FileZilla), SSH command-line tools (scp), or your hosting control panel’s file manager.

These files are often stored in a dedicated SSL directory on your server, such as /etc/ssl/. A common practice is to place the private key in a more restricted subdirectory like /etc/ssl/private/.

Securing the Private Key (File Permissions):

Your private key is the most critical component; if compromised, your site’s encryption is broken. You must restrict its file permissions so that only the root user or your web server’s user account can read it. Set the permissions to 600 (read/write for owner only) or 400 (read-only for owner).

You can change permissions using an FTP client or an SSH command:

sudo chmod 600 /path/to/your_private.key

Configuring Your Web Server

Next, you must edit your web server’s configuration to use the certificate for HTTPS traffic on port 443. This typically involves modifying a “virtual host” (Apache) or “server block” (Nginx) file.

A common point of failure is the certificate chain. For browsers to trust your certificate, your server must provide the full chain, including the intermediate certificates from the CA bundle. How you do this depends on your server:

  • Apache: Uses a separate directive, like SSLCertificateChainFile, to point to the CA bundle file.
  • Nginx: Requires you to combine your primary certificate and the CA bundle into a single file. The order is crucial: your certificate must come first, followed by the intermediates.

Your configuration will need to point to the file paths for your primary certificate, private key, and the CA bundle/chain file.

Restarting Your Web Server to Apply Changes

Configuration changes are not live until you restart or reload your web server. Before you do, always run a syntax check to avoid downtime caused by typos.

  • Apache Syntax Check: sudo apachectl configtest
  • Nginx Syntax Check: sudo nginx -t

If the check passes, proceed with the restart:

  • Apache Restart: sudo systemctl restart apache2 (Debian/Ubuntu) or sudo systemctl restart httpd (CentOS/RHEL)
  • Nginx Reload: sudo systemctl reload nginx (This applies changes without dropping connections)
  • IIS Restart: Use the IIS Manager GUI or run iisreset from the command line.

Once restarted, your server will begin serving traffic over HTTPS.

Step 3: Server-Specific Installation Guides

While the principles are the same, the exact commands and interfaces for SSL certificate installation differ between server environments. Here are guides for the most common setups.

Installing on cPanel

cPanel simplifies SSL installation through its graphical interface.

cPanel SSL/TLS installation interface - SSL certificate installation

  1. Log in to cPanel and steer to Security > SSL/TLS.
  2. Click Manage SSL sites under “Install and Manage SSL for your site (HTTPS).”
  3. Select your domain from the dropdown menu.
  4. Paste your certificate files into the corresponding fields:
    • Certificate (CRT): Your primary certificate file (.crt).
    • Private Key (KEY): Your private key file (.key).
    • Certificate Authority Bundle (CABUNDLE): The intermediate certificates file.
  5. Click Install Certificate. cPanel will handle the server configuration and restart automatically.

SSL Certificate Installation on Apache (Linux)

For Apache, you’ll need to enable the SSL module and configure a VirtualHost for port 443.

  1. Enable mod_ssl: On Debian/Ubuntu, run sudo a2enmod ssl. On CentOS/RHEL, it’s usually enabled by default, but you can install it with sudo yum install mod_ssl.
  2. Upload Files: Place your .crt, .key, and CA bundle files in a secure server directory like /etc/ssl/.

  3. Configure VirtualHost: Edit your site’s configuration file to add a VirtualHost block for port 443.

    <VirtualHost *:443>
    ServerName your_domain.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/your_domain.crt
    SSLCertificateKeyFile /etc/ssl/private/your_domain.key
    SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt

    <Directory /var/www/html>
        AllowOverride All
    • SSLEngine on: Enables SSL for this host.
    • SSLCertificateFile: Path to your primary certificate.
    • SSLCertificateKeyFile: Path to your private key.
    • SSLCertificateChainFile: Path to your intermediate certificate bundle.

  4. Enable Site and Restart: Enable the new configuration (sudo a2ensite your_domain.conf on Debian/Ubuntu), test the syntax (sudo apachectl configtest), and restart Apache (sudo systemctl restart apache2).

SSL Certificate Installation on Nginx (Linux)

Nginx is known for high performance. Installation involves creating a server block for HTTPS.

Nginx server block configuration for SSL - SSL certificate installation

  1. Combine Certificate Chain: Nginx requires the primary certificate and intermediate bundle in one file. Concatenate them:

    cat your_domain.crt ca_bundle.crt > your_domain_fullchain.crt

  2. Upload Files: Place the combined your_domain_fullchain.crt and your private key (your_domain.key) in a secure directory like /etc/nginx/ssl/.

  3. Configure Server Block: Edit your site’s configuration file to add a server block listening on port 443.

    server {
    listen 443 ssl;
    server_name your_domain.com www.your_domain.com;

    ssl_certificate /etc/nginx/ssl/your_domain_fullchain.crt;
    ssl_certificate_key /etc/nginx/ssl/your_domain.key;

    # Add modern TLS protocols and ciphers for better security
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers on;

    root /var/www/html;
    index index.html index.php;

    # Other location blocks for your application
}
    • listen 443 ssl: Tells Nginx to handle HTTPS traffic on this port.
    • ssl_certificate: Path to your combined certificate file.
    • ssl_certificate_key: Path to your private key.

  4. Enable Site and Reload: Enable the configuration if needed, test the syntax (sudo nginx -t), and reload Nginx (sudo systemctl reload nginx).

Installing on IIS (Windows Server)

On Windows Server, SSL certificate installation is done through the IIS Manager GUI.

  1. Open IIS Manager and select your server in the Connections pane.
  2. Double-click Server Certificates in the center pane.
  3. In the Actions pane, click Complete Certificate Request. Browse to your .crt file, provide a friendly name for it, and click OK. (If you have a .pfx file, use the Import action instead).
  4. Assign the Certificate:
    • In the Connections pane, expand Sites and select your website.
    • In the Actions pane, click Bindings….
    • Click Add…, set the Type to https, and select the SSL certificate you just imported from the dropdown.
    • Click OK and then Close.

IIS should now serve your site over HTTPS. A restart (iisreset) can ensure the changes are applied.

Understanding SNI for Hosting Multiple SSL Certificates

Server Name Indication (SNI) is a crucial technology that allows a single server to host multiple SSL certificates on one IP address. During the initial connection, the browser tells the server which website it’s trying to reach, allowing the server to present the correct certificate.

SNI has made HTTPS affordable and accessible, especially in shared hosting environments. It is supported by all modern web browsers and servers, eliminating the old requirement of one dedicated IP address per SSL certificate.

Step 4: Post-Installation Checks and Configuration

After the main SSL certificate installation, a few final steps are needed to ensure everything is secure and visitors are automatically directed to HTTPS.

Verifying Your SSL is Working Correctly

First, confirm the certificate is active. The easiest way is to visit your site in a browser.

  1. Check in Your Browser: Open a browser and steer to https://your_domain.com. Look for the padlock icon in the address bar, which signals a secure connection. Clicking it should show details about your certificate.

  2. Use Online Verification Tools: For a more in-depth analysis, use an online scanner.

    • Qualys SSL Labs Scanner: The SSLLabs scanner performs a comprehensive test of your SSL configuration and gives it a grade. Aim for an A or A+.
    • Why No Padlock?: The tool at whynopadlock.com is excellent for diagnosing mixed content issues, which can prevent the padlock from appearing.

Forcing HTTPS: Redirecting All Traffic to Secure

To ensure all visitors use a secure connection and to avoid SEO penalties for duplicate content, you must redirect all HTTP traffic to HTTPS.

  • For Apache (using .htaccess):
    Add this code to the top of your .htaccess file:

    RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

  • For Nginx (in your server block):
    Add a separate server block to catch HTTP traffic and redirect it:

    server {
    listen 80;
    server_name your_domain.com www.your_domain.com;
    return 301 https://$host$request_uri;
}

  • For IIS (using URL Rewrite):
    Use the URL Rewrite module to create a new rule that checks if {HTTPS} is ^OFF$ and redirects the request to https://{HTTP_HOST}/{R:1} with a permanent (301) redirect type.

  • For WordPress Sites:

    1. In your WordPress dashboard, go to Settings > General and update both the WordPress Address (URL) and Site Address (URL) to use https://.
    2. Fix Mixed Content: After updating the site URL, some images or scripts might still load over HTTP. This is called “mixed content.” Use a plugin like Better Search Replace to search your database for http://your_domain.com and replace it with https://your_domain.com. Always run a dry run first and clear all caches afterward.

Troubleshooting Common SSL Installation Errors

If things don’t work perfectly, here are solutions to common SSL certificate installation problems:

  • “Certificate Not Trusted” Error:

    • Cause: The intermediate certificate bundle was not installed correctly, breaking the chain of trust.
    • Resolution: Ensure you have correctly configured the CA bundle file (SSLCertificateChainFile in Apache or concatenated it for Nginx). Use an SSL checker to diagnose chain issues.

  • “Private Key Mismatch” Error:

    • Cause: The private key file does not correspond to the certificate. This happens if you’re using the wrong key or regenerated one after creating the CSR.
    • Resolution: You must use the exact private key that was generated with the CSR. If you’ve lost it, you will need to generate a new CSR/key pair and have the certificate reissued.

  • “Certificate Name Mismatch” Error:

    • Cause: The domain in the address bar (e.g., www.example.com) is not listed in the certificate’s Common Name or Subject Alternative Name (SAN) fields.
    • Resolution: Reissue the certificate, ensuring it covers all required domain variations (e.g., both example.com and www.example.com).

  • “Mixed Content” Warnings:

    • Cause: The page is HTTPS, but it’s loading resources (images, scripts) over HTTP.
    • Resolution: For WordPress, use a search-and-replace plugin as described above. Otherwise, you must manually update your code or database to change all http:// resource links to https://.

Conclusion: Maintaining a Secure and Trusted Website

Mastering SSL certificate installation is a foundational step for building a secure, trustworthy, and SEO-friendly website. By implementing SSL, you encrypt user data, validate your site’s identity, and show visitors that you prioritize their security. In today’s web, HTTPS is the standard, and sites without it are penalized by browsers and search engines.

However, installation is not a one-time task. Certificates expire, and regular maintenance is crucial. For example, Let’s Encrypt certificates expire every 90 days, making a reliable auto-renewal script essential to prevent service interruptions. Whether you use automated renewals from your host or manually manage commercial certificates, staying on top of expiration dates is key.

For WordPress users, proper SSL certificate installation and maintenance are core to a robust security strategy. From the initial setup to fixing mixed content issues, managing SSL can be complex. At wpOncall, we specialize in WordPress security and support. Our team in Santa Rosa, CA, can handle all these technical details for you, from installation and renewals to daily backups and unlimited support. We ensure your site stays protected, letting you focus on your business.

Ready to ensure your WordPress site is always secure and trusted?
Learn more about our WordPress SSL services