Install an external SSL certificate in cPanel

Before buying a certificate, check whether the domain can use the account's automatic SSL.

You can install an external certificate from cPanel when you need an authority or a type of certificate other than the one available through AutoSSL. On a modern server with SNI you do not need a dedicated IP for each certificate.

You will need:

• The exact name the certificate must cover.
• The corresponding private key.
• The issued certificate and, when the authority provides it, its intermediate chain or CA Bundle.

Do not share the private key or paste it into external checkers. If you lose it, the certificate cannot be installed with another key: you will have to generate a new pair and request a reissue.

Generate the CSR

1. Go to cPanel > SSL/TLS.
2. Open Certificate Signing Requests (CSR).
3. Generate a request for the domain. cPanel will create or associate a private key; keep it in the Private Keys section.
4. Copy the whole block, from BEGIN CERTIFICATE REQUEST to END CERTIFICATE REQUEST, and send it to the certificate authority.

The authority must validate domain control before issuing the certificate. Follow its validation instructions and ask for it to include all the names you will serve, such as the main domain and www where applicable.

Install the certificate

1. Go to cPanel > SSL/TLS > Manage SSL sites.
2. Select the domain and enter the certificate in CRT.
3. Use Autofill by Domain or Obtener (Fetch) to load the private key that matches the CSR. If cPanel cannot find it, do not continue until you locate the correct key.
4. Paste the intermediate chain provided by the authority into CABUNDLE. Do not make up chains or mix in chains from another issuance.
5. Install the certificate and check from a browser that the name, chain and date are correct.

Installing a manual certificate may stop that domain from using AutoSSL's automatic management while the external certificate is valid. Check who will be responsible for renewing it and securely keep the key, certificate and chain.

Check every destination

Test the domain with and without www separately if both are in use. If there is a CDN, the certificate you see may be the CDN's and not the one installed in cPanel: check both connections without disabling TLS verification.

Uploading the CRT to the list of certificates is not enough; it must be installed on the right site. Nor does it change the application's URLs by itself. Once you have validated the installation, follow the guide to enable the HTTPS redirect.

In cPanel 134 and later, these tools may appear as tabs in SSL/TLS Certificates. The private key and the CSR are still separate materials: send the authority the request, never the key.