Install an SSL Certificate: Nginx, Apache, IIS

Your download kit has the certificate, the CA chain (intermediate certificates) and a combined fullchain file. Install the fullchain with the private key you generated with your CSR, then check the result with our SSL Certificate Checker.

Nginx

Use the fullchain (your certificate + CA chain) so browsers trust the whole path:

server {
    listen 443 ssl;
    server_name yourdomain.in;
    ssl_certificate     /etc/ssl/yourdomain.fullchain.crt;
    ssl_certificate_key /etc/ssl/yourdomain.key;
}

Then test and reload: nginx -t && systemctl reload nginx.

Apache

On Apache 2.4.8 or later, point SSLCertificateFile at the fullchain file (inside your <VirtualHost *:443>):

SSLEngine on
SSLCertificateFile    /etc/ssl/yourdomain.fullchain.crt
SSLCertificateKeyFile /etc/ssl/yourdomain.key

Then: apachectl configtest && systemctl reload apache2 (or httpd on RHEL/CentOS). SSLCertificateChainFile is only needed on older Apache versions.

IIS (Windows Server)

In IIS Manager, open Server Certificates → Complete Certificate Request on the same server that created the CSR, and select the certificate file from your kit. Then edit the site's Bindings, add or edit the https binding on port 443 and choose the new certificate. If the CA chain isn't trusted, import the intermediate certificates from your kit into the Intermediate Certification Authorities store.

cPanel

No command line needed: go to Security → SSL/TLS → Manage SSL sites, pick the domain, and paste the certificate, private key and CA bundle from your kit. cPanel installs everything for you.

Verify HTTPS is working

Visit https://yourdomain.in. You should see the padlock with no warnings.
Check that the full chain is served with the SSL Certificate Checker. A missing intermediate causes "not trusted" errors on some devices even when it works in your browser.
Redirect HTTP to HTTPS so visitors always land on the secure version.

You'll repeat this at each reactivation

Certificates can now be valid for up to 200 days now; up to 100 days from 15 Mar 2027; up to 47 days from 15 Mar 2029. Each reactivation or reissue gives you a new certificate file to install in the same way. Set up free expiry alerts so you're never caught out.

If anything looks off, the usual causes are a missing CA chain or a private key that doesn't match the certificate. Bought through SSL Store? Open a support ticket with your domain and our support team will help you diagnose it. Never send your private key or server passwords in a ticket.

Common questions

How do I check the key matches the certificate?

Compare the public keys: openssl x509 -noout -pubkey -in yourdomain.crt and openssl pkey -pubout -in yourdomain.key must print the same block.

Do I reinstall after every reactivation?

Yes. Each reactivation is a new certificate file, with the same or a new key.

Which file do I use: certificate or fullchain?

Use the fullchain wherever your server takes a single certificate file. Use the separate certificate and CA bundle only where the software asks for them separately (as cPanel does).

Check my installation →

How to Install an SSL Certificate: Nginx, Apache, IIS & cPanel