How to install an SSL certificate on any web hosting

Files you need

privkey.pem and fullchain.pem. If the panel has three fields, use cert.pem and chain.pem instead of fullchain.pem.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Step by step

1. In your hosting panel, look for a section called “SSL”, “SSL certificates”, “SSL/TLS” or “Security”, and in it an option to upload your own certificate. It may be called “Import”, “Upload”, “Install” or “Custom certificate”.
2. Paste the files according to how many fields the form has (see below for which file goes where). Paste the entire contents of each file, including the “-----BEGIN …-----” and “-----END …-----” lines. If the panel asks for a file instead, select the file on your computer.
3. Save. If the panel asks, assign the certificate to your domain.

What to paste into which field

• Form with two fields: privkey.pem in the private key field, fullchain.pem in the certificate field
• Form with three fields: certificate: cert.pem, private key: privkey.pem, chain (CA, intermediate certificate, CA bundle): chain.pem

How to copy the content of a file

1. Windows: right-click the file, choose “Open with” and then “Notepad”. Mac: Control-click the file, choose “Open With” and then “TextEdit”.
2. Select all the text (Ctrl+A, on a Mac Cmd+A) and copy it (Ctrl+C, on a Mac Cmd+C).
3. In the panel, click into the field and paste (Ctrl+V, on a Mac Cmd+V). Paste everything, including the BEGIN and END lines, and don't change anything.

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• If the panel rejects the private key, generate the certificate again with an RSA 2048 key (step 1, “Key type”). Older panels do not accept ECDSA keys.
• If the panel rejects fullchain.pem in the certificate field, paste cert.pem there instead.
• If the panel accepts only a PFX or P12 file (for example Windows Server with IIS), our generator does not create that kind of file. Write to us.
• If your hosting has its own free certificate with automatic renewal, it may later replace yours. Turn it off, or use it instead of ours.
• If the panel has no option to upload your own certificate, contact your hosting provider's support. Sometimes it is enough to ask them to turn it on.

When you renew

The same steps. There is usually an option next to the domain to change or replace the certificate.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.