Install an SSL certificate
On our hosting plans a free certificate is issued automatically once the domain points here, and renewed before it expires. Usually there is nothing to do.
When it has not issued
Check cPanel under SSL/TLS Status. The usual reasons are:
- The domain is not pointing here yet. Issuance requires the certificate authority to reach the domain at this server. Until the nameservers have taken effect, it cannot.
- A CAA record blocks it. If you have a CAA record naming a different authority, add the one in use or remove the record.
- A redirect is in the way. A blanket redirect that catches
/.well-known/stops the validation request reaching the server. Exclude that path. - The subdomain does not resolve. Every hostname on the certificate has to point here, and one that does not will fail the whole request.
Once the cause is cleared, use Run AutoSSL rather than waiting for the next scheduled attempt.
Installing a certificate you bought
You need three pieces: the certificate (CRT), the private key (KEY) from when the CSR was generated, and the CA bundle. In cPanel go to SSL/TLS, Manage SSL Sites, choose the domain, and paste all three. cPanel will usually fetch the bundle for you.
If you generated the CSR on a different server, the private key is on that server and you must either retrieve it or reissue the certificate with a new CSR generated here. A certificate without its matching key cannot be installed anywhere.
After installing
Force the HTTP to HTTPS redirect, check both www and non-www, and look at the browser console for mixed content. The certificate alone does not give you the padlock - see the article on fixing mixed content.
Expiry
Free certificates renew automatically. Purchased ones do not - note the date. An expired certificate shows every visitor a full-page warning, and it always happens on a weekend.