SSL Installation: Complete Guide for All Server Types

Complete SSL Certificate Installation Guide for Your Server

SSL installation can seem intimidating the first time, but it is a logical process once you understand each step. This guide covers everything from choosing a validation type, to installing on cPanel, Nginx, and Apache, to verifying your setup with professional tools.

Validation Types: DV, OV, and EV

Before requesting a certificate, understand what each validation level means:

DV (Domain Validation): The Certificate Authority (CA) only verifies you control the domain. Issues within minutes. Available free via Let's Encrypt or at very low cost from commercial CAs. Appropriate for blogs and informational sites.

OV (Organization Validation): Verifies your business exists legally. Takes 1-3 business days. Suitable for stores and corporate sites.

EV (Extended Validation): Deep verification of company identity. Takes 3-7 business days. Required for banks, financial institutions, and government portals.

Step One: Generate a CSR

A CSR (Certificate Signing Request) is a file generated on your server containing your domain and organization information. The CA uses it to create your certificate.

On the server (Linux):

openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

You will be prompted for:

• Country Name: US, SA, or your two-letter country code
• State/Province: Your state or region
• Organization: Your legal company name
• Common Name: The domain (e.g., www.yourdomain.com)

Critical: Keep the .key file secure and backed up. If you lose it, the certificate cannot be used and you will need to reissue.

Installing SSL on cPanel via AutoSSL

cPanel includes AutoSSL which installs Let's Encrypt certificates automatically:

1. Navigate to Security then SSL/TLS Status
2. Select the domains you want to secure
3. Click Run AutoSSL
4. Wait approximately two minutes — the certificate installs and auto-renews every 90 days

For paid certificates on cPanel:

1. Go to SSL/TLS then Manage SSL Sites
2. Paste the contents of your .crt file (certificate), .key file (private key), and .ca-bundle file (intermediate certificates)
3. Click Install Certificate

Manual Installation on Nginx

server {
 listen 443 ssl;
 server_name yourdomain.com www.yourdomain.com;

 ssl_certificate /etc/ssl/certs/yourdomain.crt;
 ssl_certificate_key /etc/ssl/private/yourdomain.key;
 ssl_trusted_certificate /etc/ssl/certs/ca-bundle.crt;

 ssl_protocols TLSv1.2 TLSv1.3;
 ssl_ciphers HIGH:!aNULL:!MD5;
 ssl_prefer_server_ciphers on;

 # HSTS header
 add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
 listen 80;
 server_name yourdomain.com www.yourdomain.com;
 return 301 https://$server_name$request_uri;
}

After editing the configuration:

nginx -t # Test configuration syntax
systemctl reload nginx

Manual Installation on Apache

<VirtualHost *:443>
 ServerName yourdomain.com
 SSLEngine on
 SSLCertificateFile /etc/ssl/certs/yourdomain.crt
 SSLCertificateKeyFile /etc/ssl/private/yourdomain.key
 SSLCertificateChainFile /etc/ssl/certs/ca-bundle.crt
 SSLProtocol -all +TLSv1.2 +TLSv1.3
 Header always set Strict-Transport-Security "max-age=31536000"
</VirtualHost>

a2enmod ssl headers
systemctl restart apache2

Intermediate Certificates: The Most Common Mistake

The most frequent SSL installation error is installing only the primary certificate without the intermediate certificates. The result: browsers display a "certificate chain incomplete" error, especially on older browsers and Android devices.

When you purchase a certificate, you receive three components:

1. yourdomain.crt — your primary certificate
2. ca-bundle.crt or intermediate.crt — intermediate certificates from the CA
3. yourdomain.key — your private key (generated by you during CSR)

All three must be installed and correctly referenced.

Private Key Security

The private key is the most sensitive file in this process. Best practices:

• Permissions should be 600 (read/write for owner only): chmod 600 yourdomain.key
• Never store it in a web-accessible directory
• Never paste it in email or chat
• Store an encrypted backup in a secure location separate from the server
• If compromised, revoke the certificate immediately and reissue

Testing with SSL Labs

After installation, validate your configuration at ssllabs.com/ssltest. Enter your domain and wait for the analysis. The goal is an A or A+ rating.

The test reveals:

• Whether the certificate chain is complete
• Whether deprecated protocols (TLS 1.0, TLS 1.1) are disabled
• Whether HSTS is enabled
• Whether known vulnerabilities like Heartbleed or POODLE are present
• Certificate expiry date

An A+ rating requires HSTS with a long max-age and no mixed content issues.

Renewal Process

Let's Encrypt certificates are valid for 90 days. With Certbot installed, renewal is automatic:

certbot renew --dry-run # Test the renewal process

Set a cron job if Certbot did not configure one automatically:

0 0,12 * * * certbot renew --quiet

Commercial certificates renew annually or biennially. Set a calendar reminder 30 days before expiry. Most CAs send email reminders, but do not rely solely on them.

On cloud.net.sa, free SSL certificates are managed automatically — no manual renewal steps required.

Post-Installation Checklist

1. Does the padlock appear in the browser?
2. Does ssllabs.com give an A or A+ rating?
3. Is HTTP automatically redirecting to HTTPS?
4. Are intermediate certificates included in the chain?
5. Is HSTS header present?
6. Is the private key permissions set to 600?
7. Is renewal automation confirmed and tested?

Completing every item on this list means your SSL installation is production-ready.

---

Get Started

Want to try it yourself? Choose the right hosting plan or build your custom server with the specs you need.