Skip to main content
Submit a request

How to install a third-party or purchased SSL

Maxim Tsitsejev
Updated

Applies to: All plans.

Most customers do not need this. Every Maxinodes plan includes free AutoSSL (Let's Encrypt), which issues and renews a valid certificate automatically. Only follow this guide if you have specifically bought a certificate from a third-party provider (for example an Organisation Validated or Extended Validation cert) and need to install it yourself.

Heads-up: A purchased certificate does not auto-renew. You must repeat this process each time it expires. AutoSSL renews itself for free.

Before you start: You need:

  • Your cPanel login (reached by single sign-on from client area -> Services -> My Services -> your hosting -> Login to cPanel).
  • The exact domain name the certificate is for.
  • Either a certificate you have already purchased, or the details to buy one once you have a CSR.

Step 1 — Generate a CSR and private key

A Certificate Signing Request (CSR) is the file your SSL provider needs to issue the certificate. Generate it on our server so the matching private key stays here.

  1. In cPanel, go to Security -> SSL/TLS.
  2. Open Certificate Signing Requests (CSR) -> Generate, view, or delete SSL certificate signing requests.
  3. Fill in the fields: the Domains (your domain), City, State, Country, Company and Email. Use real, accurate details — many providers validate them.
  4. Click Generate.

Result: cPanel shows your Encoded Certificate Signing Request. Copy the whole block (including the -----BEGIN----- and -----END----- lines) and paste it into your SSL provider's order form.

Step 2 — Get your certificate from the provider

Your provider will complete domain (and possibly organisation) validation, then give you the issued certificate. Keep these to hand:

  • The certificate itself (the CRT block).
  • The CA Bundle / intermediate certificate, if supplied.

You do not need to ask them for a private key — yours was generated in Step 1 and never left our server.

Step 3 — Install the certificate

  1. In cPanel, go to Security -> SSL/TLS.
  2. Open Install and Manage SSL for your site (HTTPS) -> Manage SSL Sites.
  3. Choose your Domain from the list.
  4. Paste the issued Certificate (CRT) into the first box.
  5. The Private Key (KEY) should auto-fill from the matching CSR. If it does not, paste it from Private Keys (KEY) in the SSL/TLS area.
  6. Paste the Certificate Authority Bundle (CABUNDLE) if your provider gave you one.
  7. Click Install Certificate.

Result: cPanel confirms the certificate is installed. Visit https://yourdomain.com and check for the padlock and the correct certificate details in your browser.

Step 4 — Force HTTPS

Once the certificate is live, redirect visitors from http:// to https:// so everyone gets the secure version. See Free SSL (AutoSSL) and how to force HTTPS for the redirect steps — they are the same for any certificate.

Troubleshooting this task

  • Padlock missing or "Not secure" after install. This is usually mixed content — hard-coded http:// links to images or scripts. See Why does my site show 'Not Secure' or mixed content?.
  • "Certificate and key do not match". The certificate must pair with the CSR you generated in Step 1. Re-issue the certificate using a CSR from this server, do not reuse one from elsewhere.
  • Browser warns about an untrusted or incomplete chain. You skipped the CA Bundle. Re-run Step 3 and paste the intermediate certificate your provider supplied.
  • Site still loads the old AutoSSL cert. Give it a few minutes, then hard-refresh. If it persists, contact support with your domain.
  • Certificate expired. Purchased certificates do not auto-renew. Buy/renew with the provider and repeat Steps 1–3, or switch back to free AutoSSL.

Remember our DNS lives in the client area (managed by us, on our own nameservers), not the cPanel zone editor — but SSL certificates are installed in cPanel, as above.

Related articles

Comments

0 comments

Please sign in to leave a comment.