SearchSupportDocsFree trial
Contact us
Sectigo Blog

SSL certificate installation instructions

SSL/TLS certificates secure digital communication through encryption and authentication, allowing websites and applications to protect data in transit and use HTTPS. These certificates are typically issued by a Certificate Authority (CA) and must be installed correctly to work as intended.

Installation involves uploading certificate files and configuring servers, with specific instructions for platforms like Zimbra, Nginx, Tomcat, and more. Prior steps include generating a CSR and choosing the right SSL type, while post-installation actions focus on testing, monitoring, and renewal. Trusted CAs like Sectigo simplify the process with guidance and SSL certificate options for different website and business needs.

Sectigo Team
By Sectigo Team, Delivering Digital TrustApril 7, 20267 min read

SSL stands for Secure Sockets Layer, while TLS stands for Transport Layer Security, the modern protocol used today. Once issued by a trusted CA, an SSL/TLS certificate must be installed to move from the enrollment stage to the provisioning stage of the certificate lifecycle. This makes the certificate active and ready for use. 

While certificate installation is a technical process, it doesn’t have to be overwhelming. This guide breaks down how SSL certificate installation works, what to prepare before you begin, and how to install certificates across common servers and platforms.

How do you install an SSL certificate?

There are multiple steps involved in the SSL/TLS certificate process.

  1. Choose the type of certificate you need along with the right validation level. 
  2. Purchase the SSL from a trusted CA. 
  3. Generate and submit a CSR (certificate signing request) to the CA. 
  4. The CA should then provide specific instructions for completing domain validation.
  5. Once validation is complete, the CA will send the SSL certificate files for download. These may include multiple files, such as the certificate itself and the intermediate certificate that links the root certificate to end-user certificates. 
  6. For most servers, the next step involves uploading the certificate files and then editing the configuration files as needed.
  7. Test the installation. 
  8. Monitor and renew the certificate before expiration.

We’ve included more information on what’s needed prior to installation below. 

Determine which type you need

Before you can install your certificate, you need to determine which type of SSL certificate will actually be installed. There are several options available, but this decision will ultimately come down to the level of validation needed and the number of domains that need to be covered. 

There are three validation levels including extended validation (EV), which offers the highest level of validation, organization validation (OV), and domain validation (DV). You must then determine if you need a single domain, wildcard, or multi-domain SSL certificate.

Purchase the SSL certificate

It’s recommended to buy your certificate from a trusted Certificate Authority, such as Sectigo. The CA is responsible for validating certificate requests and issuing certificates that browsers and systems recognize as trusted. After you complete the purchase, the CA will guide you through the next steps, including certificate validation and issuance

Generate a CSR

Certificate signing requests play a critical role in the early stages in the SSL certificate lifecycle, including request, enrollment, and issuance. These must be created and submitted at the beginning of the process and, without them, installation will not be possible. These encrypted messages contain crucial information about the individuals or organizations who seek SSL/TLS certificates.

Information used to identify the requester include:

  • One or more Subject Alternative Names (SANs), which reveals a specified location within the Domain Name System (DNS).
  • An organization name, such as an official company name, for OV and EV certificatesThe legal address in which the organization is located.
  • (optionally) The email address used by — or associated with — the requesting organization.

Creating a CSR automatically generates a public key, which functions as half of the key pair needed for SSL certificates. Once equipped with the CSR's information, the CA should be prepared to create the requested certificate.

SSL installation for different servers/platforms

The SSL installation process can play out differently with various services and platforms. To that end, you'll want to follow server-specific instructions to ensure that the certificate is installed correctly. We've highlighted a few examples of installation procedures below:

  • Zimbra. Access the Zimbra Admin Console before selecting Configure, followed by Certificate. Next, select Install Certificate. Use the Certificate Installation Wizard to select the target server and the option for installing the "commercial signed certificate." Upload the files before clicking Install.
  • Nginx Webserver. You will receive a 'ca-bundle' file via ZIP. Use the command cat domain_com.crt domain_com.ca-bundle > ssl-bundle.crt to concatenate the certificate file and the CAbundle. Next, store the bundle and the private key in the relevant nginx ssl folder. Consider using OCSP Stapling to boost the SSL handshake speed. Check for syntax errors and then restart the server.
  • Tomcat KeyStore. Begin with the command keytool -import -trustcacerts -alias server -file your_site_name.p7b -keystore your_site_name.jks. A confirmation should reveal that the certificate reply was installed. Confirm that you want to trust the certificate. To configure, open the Tomcat server.xml file in a text editor. Find the connector that the keystore will secure. Specify the keystore filename and password. Save changes in the server.xml file and restart Tomcat.
  • Outlook Web Access. Open Internet Services Manager followed by Properties. Select Directory Security and Server Certificates. In Pending Certificate Request, select the option to process the pending request. Find the previously received certificate in Process a Pending Request. View the certificate summary and click Next. Install the intermediate certificate and enable SSL for Outlook Web Access. This involves the Exchange directory, and specifically, the Directory Security tab. Click Edit in Secure Communication. Check the relevant box for Require Secure Channel (SSL).

This is just a small sample of the different processes that may be followed when installing SSL/TLS certificates. Sectigo provides easy access to a wealth of server and platform-specific instructions, including the following:

Installation for Apache OpenSSL

Installation for Microsoft IIS

Installation for Nginx

Installation for Tomcat

Installation for cPanel / WHM

Installation for Plesk

Installation for Microsoft Exchange

Installation for AWS

Installation for Microsoft Azure

Installation for Google Cloud

Installation for Node.js

Installation for LiteSpeed

Installation for Oracle WebLogic

Installation for IBM HTTP Server

Installation for SAP

Installation for Cisco

Installation for Citrix

Installation for F5 BIG-IP

Installation for Palo Alto

Installation for Fortigate

Installation for SonicWall

Installation for pfSense

Installation for HAProxy

Installation for Traefik

Installation for Zimbra

Installation for FreeIPA

Installation for FileZilla

Installation for IceWarp

Installation for Outlook Web Access (OWA)

Testing and renewing

After an SSL certificate is installed, it will need to be tested and, eventually, renewed before it expires.

Various command-line tools (such as OpenSSL) can confirm that SSL/TLS certificates have been installed correctly. These tools may also check for vulnerabilities. Following a successful test, monitor the certificate to ensure that any new vulnerabilities are promptly revealed and addressed.

Public SSL certificate validity periods have recently been reduced. As of March 15, 2026, they can have a maximum validity period of 200 days. That limit will drop to 100 days on March 15, 2027, and 47 days on March 15, 2029. As certificate lifespans continue to shorten, it is important to know how long each certificate will remain valid and what renewal steps are required. Certificate lifecycle management automation helps to prevent missed renewals or outages.

If you encounter issues during or after installation, consult your certificate authority for support. In addition to providing the actual digital certificate, the CA will ideally offer guidance, including detailed instructions for installing certificates, troubleshooting and other support services.

Trust Sectigo with your SSL certificate needs

Choosing the right CA is crucial for ensuring a seamless installation process and making the most of your SSL/TLS certificates once they are installed. Stick with a trusted CA that has a strong track record and a reputation for working closely with customers.

Sectigo offers digital certificates to suit every type of organization. We offer everything from single SSL certificates to wildcard and multi-domain options. What's more, we accommodate all validation levels. Feel free to browse our products or get in touch to discover how various types of SSL/TLS certificates can enhance your security strategy.

Related posts:

See all resources