How to install an SSL certificate in Plesk
In short
In Plesk, open “SSL/TLS Certificates” for your domain, add a certificate and paste privkey.pem, cert.pem and chain.pem as text. Then, in the domain's hosting settings, turn on SSL/TLS support and select the new certificate.
Plesk Obsidian is a control panel used by many hosting providers and on VPS servers. Some menu names differ between Plesk versions; where they do, we give both.
Files you need
privkey.pem, cert.pem and chain.pem. Plesk does not document uploading ECDSA keys, and there are reports that it rejects them, so choose “RSA 2048” in step 1 of the generator.
Upload the certificate from production mode. A certificate from test mode is only for checking the process: browsers don't trust it, and some panels won't accept it at all.
Step by step
- Go to “Websites & Domains” (in some versions “Domains”) and open “SSL/TLS Certificates” for your domain.
- If the domain has no certificate yet, scroll down to “More options” and click “Manage” under “Download or remove existing certificates”. If the domain already has a certificate, click “Advanced Settings”. Then click “Add SSL/TLS Certificate”.
- Enter any name for the certificate, for example the domain name and the date.
- In the “Upload the certificate as text” section, paste the files into the three fields (see below for which goes where) and click “Upload Certificate”.
- Assign the certificate to your website. In the newer interface, click “Hosting & DNS” under your domain, then “Hosting”. In the older one, go to “Websites & Domains” → “Hosting Settings”. In the “Security” part (in newer versions, the “SSL/TLS support” part), tick “SSL/TLS support” (or “Enabled”), choose the new certificate in the “Certificate” menu and click “OK” (or “Apply”).
What to paste into which field
- Private key (*.key): the entire contents of privkey.pem
- Certificate (*.crt): the entire contents of cert.pem
- CA certificate (*-ca.crt): the entire contents of chain.pem
How to copy the content of a file
- Windows: right-click the file, choose “Open with” and then “Notepad”. Mac: Control-click the file, choose “Open With” and then “TextEdit”.
- Select all the text (Ctrl+A, on a Mac Cmd+A) and copy it (Ctrl+C, on a Mac Cmd+C).
- In the panel, click into the field and paste (Ctrl+V, on a Mac Cmd+V). Paste everything, including the BEGIN and END lines, and don't change anything.
Checking the result
Open your website over https:// and click the padlock (or the settings icon) next to the address. The certificate details should show Let's Encrypt as the issuer and an expiry date matching the panel. If the browser still shows the old certificate, wait a few minutes and reload the page.
If you see a warning instead of your website, we explain the error codes on the page “Your connection is not private”. If the site opens over https but looks broken or something doesn't work, see mixed content. Finally, turn on the redirect from http to https so everyone lands on the secure version.
Good to know
- Paste the text instead of uploading a file. The “Upload” button on the “SSL/TLS Certificates” page accepts only a single .pem file with the key and the certificate together, and the generator saves them as separate files.
- Plesk's automatic Let's Encrypt feature (“Keep websites secured”) only replaces certificates that are expired or self-signed, or adds one where there is none. It will not touch your valid certificate.
When you renew
Add the new certificate using the same steps and select it in the hosting settings. You can then delete the old certificate from the list.
Hosting panels change from time to time. If something looks different from this guide, write to kontakt@freessl.pl and we'll update it.