How to install an SSL certificate on OVHcloud Web Hosting

Files you need

cert.pem, privkey.pem and chain.pem. OVHcloud accepts only certificates with an RSA key, so choose “RSA 2048” in step 1 of the generator.

Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.

Before you start

• OVHcloud Web Hosting has a built-in free Let's Encrypt certificate, which OVHcloud turns on by default and renews itself. If it already works on your website, you do not need to upload anything. You can upload your own certificate only when the domain has no active certificate, and you then renew it by hand.
• If a certificate is active, disable it for every name that will be in your certificate. In the “SSL certificates” tab, each name (for example example.com and www.example.com) has its own row: in the row, click the three-dot button (⋮), then “Disable SSL” and “Confirm”. According to OVHcloud, this takes up to a few hours. From the moment you disable it until the new certificate is installed, your website works without https.
• Every name in the certificate (for example example.com and www.example.com) must point to the IP address of your hosting plan and be added to one of the websites in the “My sites” tab (formerly “Multisite”).
• OVHcloud support does not help with installing certificates that OVHcloud did not provide. If you run into trouble, write to us.

Step by step

1. Log in to the OVHcloud Control Panel. Go to “Web Cloud”, then “Hosting plans”, and select your hosting plan.
2. Open the “SSL certificates” tab and click “Import your own SSL certificate”.
3. Paste the contents of the files into the three fields (see below for which file goes where) and click “Confirm”.
4. The installation takes several minutes. After that, your certificate appears in the table in the “SSL certificates” tab with the certificate type “Custom”.

What to paste into which field

• “Copy the content of your certificate (Only RSA)”: the entire contents of cert.pem (the certificate alone, not fullchain.pem)
• “Copy the content of your private key (not encrypted)”: the entire contents of privkey.pem
• “Copy the content of your certificate chain”: the entire contents of chain.pem

How to copy the content of a file

1. Windows: right-click the file, choose “Open with” and then “Notepad”. Mac: Control-click the file, choose “Open With” and then “TextEdit”.
2. Select all the text (Ctrl+A, on a Mac Cmd+A) and copy it (Ctrl+C, on a Mac Cmd+C).
3. In the panel, click into the field and paste (Ctrl+V, on a Mac Cmd+V). Paste everything, including the BEGIN and END lines, and don't change anything.

Checking the result

Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.

If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.

Good to know

• The message “error check SAN from certificate” means that one of the names in the certificate does not point to the IP address of your hosting plan or is not added in the “My sites” tab.
• OVHcloud does not describe importing a wildcard certificate (*.example.com). On OVHcloud Web Hosting it is safer to generate a certificate for specific names, for example example.com and www.example.com.

When you renew

The domain must not have an active certificate. First, in the “SSL certificates” tab, disable the current one in the row of each name (three-dot button → “Disable SSL” → “Confirm”), then import the new one using the same steps. Do this a few days before the certificate expires: disabling takes up to a few hours, and your website works without https until the new certificate is installed.

DNS record for domain verification

If your domain is at OVHcloud and you verify it with a DNS record: “Web Cloud” → “Domain names” → your domain → “DNS zone” tab. Above the table, click “Add an entry” and choose “TXT” as the type. In the “Subdomain” field, enter the short name shown by the generator (for example _acme-challenge), because the panel adds your domain itself. Paste the value from the generator and click “Add”.

Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.