Install an SSL Certificate: 4 Methods, Step by Step

By Umair Ali Sadaqat · Updated November 6, 2026 · Editorial policy

How to install an SSL certificate on a hosted builder, cPanel, Nginx or Apache, or with Let's Encrypt and certbot, plus the checks that prove it works.

Short answer: How you install an SSL certificate depends on where your site lives. On a hosted website builder it is automatic, so you only connect your domain. On cPanel hosting, AutoSSL usually handles it, or you paste a certificate and key into the SSL/TLS tools. On your own Nginx or Apache server, the quickest route is Let's Encrypt with certbot, which fetches the certificate, edits your config and sets up renewal. After any install, confirm the padlock, the redirect from http to https, and the renewal.

Which installation method fits you?

Where your site runs	What you do	Effort	Renewal
Hosted website builder	Connect your domain; HTTPS is provisioned for you	Lowest	Handled by the platform
Shared hosting with cPanel	Use AutoSSL, or install a purchased certificate under SSL/TLS	Low to medium	AutoSSL renews; a purchased certificate you renew yourself
Your own VPS with Nginx or Apache	Run certbot, or install certificate files by hand	Medium	Certbot sets up an automatic renewal job
Paid certificate from a vendor	Generate a CSR, submit it, install the files you receive	Highest	You renew manually before expiry

If you are not sure which certificate you need (domain-validated, organization-validated, wildcard), read SSL certificate types first. If you are weighing free against paid, SSL certificate cost lays out the options. For the basics, see what is an SSL certificate.

Before you start: the checklist

Run through this before touching any server. Most failed installs trace back to one of these items.

[ ] Your domain's A/AAAA record (or CNAME) points at the server or platform you are installing on.
[ ] You can reach the site over plain http:// on port 80 if you plan to use certbot's webroot, Nginx, or Apache plugins.
[ ] Port 443 is open in your firewall and hosting provider's security group.
[ ] You know every name the certificate must cover: example.com and www.example.com.
[ ] If you have CAA records on your domain, one of them allows the certificate authority you are using.
[ ] You have a backup of your current server config.

Method 1: Hosted website builder (automatic)

With a hosted builder you do not generate keys or edit server files. The general pattern is:

Add your custom domain in the builder's domain settings.
At your registrar, create the DNS records the builder tells you to create.
Wait for DNS to propagate, then open the site with https:// on both the root domain and www.
If the padlock does not appear, recheck the DNS records. Certificates cannot be issued until the domain points to the platform.

That is the entire process. If you are still choosing a platform, We.Inc's free plan lets you publish up to three sites from ready-made templates; the AI builder that drafts a site from a prompt starts on the Starter plan at $20 a month. You can sign up here.

Method 2: cPanel hosting

cPanel has two paths. Check the first before doing the second.

Check AutoSSL first

Open cPanel > Security > SSL/TLS Status. According to cPanel's documentation, this interface lets you view, upgrade, or renew your domains' certificates and spot unsecured or expiring domains. If your domain shows no valid certificate, run AutoSSL from the same screen if your host has enabled it. Your hosting provider controls whether this feature is available (it is set in WHM's Feature Manager), so if you do not see it, ask your host.

Install a purchased certificate manually

Go to cPanel > Security > SSL/TLS. Under private keys, generate a key (or upload one you already have). cPanel warns that a lost private key cannot be recovered, so keep a copy somewhere safe.
Generate a certificate signing request (CSR) for your domain and submit it to the certificate vendor.
Complete the vendor's domain validation and download the certificate and CA bundle.
Return to the SSL/TLS area, open the screen for installing and managing SSL for your site, and paste in the certificate, matching private key and CA bundle.
Save, then test the site over https://.

cPanel's documentation notes that CAA records in your zone file restrict which certificate authorities may issue for your domain. If issuance fails, check the Zone Editor under cPanel > Domains > Zone Editor for a conflicting CAA record.

Interface names can shift between cPanel versions, so use the on-screen labels if your layout differs slightly.

Method 3: Let's Encrypt with certbot (Nginx or Apache)

This is the standard route for a VPS or dedicated server you manage yourself. The steps below follow the Certbot instructions for Nginx on Linux using snap (checked November 2026). Certbot's site has matching instructions for Apache and other systems, so pick your own combination there.

Make sure your site already answers on http://yourdomain.com. Certbot's Nginx and Apache modes need an existing HTTP site reachable on port 80.
If you have an older certbot from your OS package manager, remove it first (for example with apt, dnf, or yum).
Install certbot:

``bash sudo snap install --classic certbot sudo ln -s /snap/bin/certbot /usr/local/bin/certbot ``

Get a certificate and let certbot edit your Nginx config automatically:

``bash sudo certbot --nginx ``

To get the certificate only and edit the config yourself, use sudo certbot certonly --nginx instead. For Apache, the equivalent flag is --apache.

Test automatic renewal:

``bash sudo certbot renew --dry-run ``

Certbot's packages come with a cron job or systemd timer that renews certificates before they expire, and systemctl list-timers shows whether the timer is active. If port 80 is blocked, or you want a wildcard certificate, use DNS validation instead.

Method 4: Install certificate files by hand in Nginx

Use this when a vendor gave you a certificate file and a CA bundle. The Nginx documentation describes the required pieces: the ssl parameter on the listening socket, plus the certificate and key paths.

``nginx server { listen 443 ssl; server_name www.example.com; ssl_certificate www.example.com.chained.crt; ssl_certificate_key www.example.com.key; } ``

Two details cause most manual-install errors:

Chain order. If the vendor supplies a bundle, join the files with your server certificate first: cat www.example.com.crt bundle.crt > www.example.com.chained.crt. Nginx's docs warn that reversing the order makes nginx fail to start with a "key values mismatch" error.
Key permissions. The private key file should have restricted access but must still be readable by nginx's master process.

By default nginx uses TLSv1.2 and TLSv1.3, so you generally do not need to set protocols explicitly. Run sudo nginx -t to test the config, then reload nginx.

For Apache, the same three ingredients apply: enable the SSL module, point the SSL virtual host at your certificate, key and chain files, then test the config and reload. Directive names differ from Nginx, so follow your distribution's Apache documentation.

Verify the install

Do not stop at "the site loads." Check each item:

Padlock on both names. Visit https://example.com and https://www.example.com.
Redirect. Open http://example.com and confirm it lands on https://.
Chain. Run openssl s_client -connect example.com:443, the command the Nginx documentation suggests for confirming the server sends the full chain.
Mixed content. Open your browser's developer console on a few pages and look for blocked http:// requests. Update those URLs to https://.
Expiry and renewal. Note the expiry date and confirm that renewal is automatic, or put the date in your calendar.

Troubleshooting quick list

Browser warns about an untrusted issuer: the intermediate certificate is missing. Rebuild the chained file as shown above.
Nginx will not start after the change: check certificate and key order and that the key matches the certificate.
Certbot cannot validate: confirm DNS points at this server and port 80 is open, or switch to DNS validation.
Certificate covers the wrong name: reissue it with both the root domain and www listed.

If you are building a local-service site and want it to rank, HTTPS is only the baseline. See how solar installers and gutter installers structure their sites for the next steps.

Frequently asked questions

How long does it take to install an SSL certificate?

On a hosted builder or a host with automatic SSL, the certificate is usually issued without any action from you once your domain points at the right place. Manual installs on your own server take as long as it takes to generate a key, get the certificate issued, edit the config and reload the server. Issuance time depends on the certificate authority and the validation method, so there is no single number that holds for every provider.

Is a Let's Encrypt certificate really free, and how long does it last?

Yes, Let's Encrypt issues certificates at no charge. Its FAQ says default certificates are valid for 90 days, with no way to adjust that, and recommends renewing 90-day certificates every 60 days. Let's Encrypt has also announced that its default profile moves to 64-day certificates on February 10, 2027 and 45-day certificates on February 16, 2028, which is one more reason to automate renewal rather than do it by hand (checked November 2026).

Why does my browser still say "Not secure" after I installed the certificate?

The most common causes are an incomplete certificate chain (the intermediate certificate is missing), a certificate issued for a different name than the one you are visiting, such as the bare domain instead of www, or mixed content, where the page is HTTPS but still loads images or scripts over http://. Test the chain with openssl s_client and look for http:// URLs in your page source.

What is the difference between the certificate file and the private key?

The certificate is public: your server sends it to every visitor. The private key stays on your server and proves you own the certificate. The Nginx documentation says the key should be stored in a file with restricted access, but it must be readable by nginx's master process. If you lose the key, you cannot recover it and must get a new certificate.

Do I need to install an SSL certificate if I use a website builder?

Usually not. Hosted builders typically provision and renew HTTPS for connected domains automatically. What you still need to do is point your domain's DNS at the builder and confirm that the padlock appears on both the root domain and the www version after it connects.

Related guides and tools

Start building

How we research, test and update this page: our editorial policy. We.Inc is our own product.