How to Install a Free SSL Certificate in cPanel? A Step-by-Step Guide

The vast majority of shared hosting users manage their servers through cPanel. In this guide, we'll show you step by step how to install a free SSL certificate into cPanel's SSL/TLS manager. The process takes about 5 minutes on average and does not require you to connect to the server via SSH.

Before you start: you need 3 files

To install an SSL certificate, you must have three pieces on hand:

• Certificate (certificate.crt) — the public certificate signed for your domain.
• Private key (private.key) — the secret key that matches the certificate. Do not share it with anyone.
• CA Bundle (ca_bundle.crt) — the intermediate chain certificates that link your certificate to the root authority.

If you haven't generated these three files yet, you can verify your domain and obtain them in minutes with our free SSL wizard. The ZIP package you download at the end of the wizard contains certificate.crt, private.key, ca_bundle.crt, fullchain.pem, and certificate.pfx. For cPanel, the first three are enough.

Step 1 — Open the SSL/TLS manager in cPanel

On the cPanel home screen, go to the Security section and click the SSL/TLS icon. On the page that opens, select the "Manage SSL sites" link.

Step 2 — Select the domain

Under the "Install an SSL Website" heading, use the Domain menu to select the domain you want to install the certificate on. If you obtained a certificate that also covers the www subdomain, selecting the root domain is enough.

Step 3 — Paste the contents of the three files

In this step, you'll open the files with a text editor (Notepad, VS Code, etc.), copy their contents, and paste them into the relevant boxes:

1. Certificate (CRT): Open the certificate.crt file, copy all the text starting with -----BEGIN CERTIFICATE-----, and paste it into the first box.
2. Private Key (KEY): Paste the entire private.key file into the second box. cPanel usually finds the key automatically; if it doesn't, add it manually.
3. Certificate Authority Bundle (CABUNDLE): Paste the contents of ca_bundle.crt into the third box. Leaving this box empty leads to a "missing intermediate chain" error.

The beginning of a PEM file looks like this:

-----BEGIN CERTIFICATE-----
MIIFazCCA1OgAwIBAgIRAIIQz7DSQ...
... (long base64 text) ...
-----END CERTIFICATE-----

Step 4 — Click the "Install Certificate" button

After filling in the three fields, click the Install Certificate button at the bottom of the page. When you see the "SSL Host Successfully Installed" message, the installation is complete.

Step 5 — Test HTTPS and set up redirection

Open https://yourdomain.com in your browser and look for the lock icon in the address bar. Then, to automatically move visitors to HTTPS, add the following rule to the .htaccess file in your account's root directory:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

The 301 redirect both directs visitors to the secure version and tells Google that your site has permanently moved to HTTPS; this prevents loss of value in terms of SEO.

Common problems

• "Certificate and key do not match": The CRT and KEY belong to different requests. Make sure you use the pair that came from the same ZIP.
• "ERR_CERT_AUTHORITY_INVALID": The CA Bundle field was left empty. Don't forget to add the contents of ca_bundle.crt.
• Conflict with AutoSSL: Some providers issue their own certificate via AutoSSL. If your manual certificate doesn't take priority, disable AutoSSL for that domain.

Summary

Installing SSL in cPanel comes down to pasting the contents of three PEM files into the correct boxes. If you don't have a certificate yet, generate your certificate valid for 90 days with our free SSL wizard, download the ZIP, and follow this guide. You can renew your certificate for free by repeating the same steps every 90 days.