In cPanel, go to SSL/TLS → Manage SSL Sites. You'll need three things from your certificate authority: the certificate (CRT), your private key, and the CA bundle (intermediate certificates).
- Paste the certificate into the "Certificate" field — cPanel will attempt to auto-fill the domain and private key if it recognizes them.
- Paste the private key into the "Private Key" field.
- Paste the CA bundle into the "Certificate Authority Bundle" field — skipping this causes "not trusted" warnings on some devices even though the cert itself is valid.
- Click Install Certificate.
Or skip all of it: AutoSSL
If you don't exactly need a paid certificate (EV, extended warranty, wildcard from a specific vendor), cPanel's AutoSSL issues and auto-renews free domain-validated certificates for every domain on the account with zero manual steps. For most sites, this is the better default.
What to do if the certificate and key don't match
cPanel will refuse to install a certificate whose private key doesn't match — a common issue if you're installing a certificate someone else generated for you, or reinstalling after a server migration. Confirm the match independently before troubleshooting cPanel itself: run openssl x509 -noout -modulus -in certificate.crt | openssl md5 and openssl rsa -noout -modulus -in private.key | openssl md5, and compare the two output hashes. If they don't match, you have the wrong key for that specific certificate — a fresh CSR and reissued certificate is the fix, not a cPanel setting.
Why the CA bundle field trips people up
The "Certificate Authority Bundle" field is where the intermediate certificate(s) go — not a second copy of your own certificate. Leaving this blank is the most common reason a certificate installs successfully in cPanel but still shows a chain error to some visitors: the site works fine in a browser that already has the intermediate cached from visiting another site, but fails in a stricter client (an API library, an older browser) that has no such cache to fall back on. Your CA's account portal has the correct bundle for your specific certificate — pasting the wrong or an outdated one produces the same symptom, so if the error persists after adding a bundle, confirm you have the current one for this specific issuance, not a previously downloaded copy.
Reseller and shared hosting considerations
On a reseller or shared hosting account, whether you can access "SSL/TLS → Manage SSL Sites", or need to go through your hosting provider, depends on permissions your provider has configured — this isn't a cPanel limitation itself but an account-level one. If the option isn't visible at all, that's the first thing to check with your host rather than assuming something is broken in your specific setup.
Loading comments…