Knowledge Base

Overview

This article describes the recommended steps to generate a CSR, prepare the certificate file, and install an SSL certificate on an IceWarp Mail Server using OpenSSL and the IceWarp Server Console.

Prerequisites

• OpenSSL installed on the server or a local machine
• Access to the IceWarp Server Console

Steps to install SSL certificate IceWarp

Step 1: Generate Private Key and CSR Using OpenSSL

1. Open a command prompt or terminal.
2. Run the following command to generate a 3072-bit RSA private key and CSR:

openssl req -newkey rsa:3072 -nodes -keyout private.key -out request.csr

3. When prompted, enter the required CSR details.
4. Submit the generated CSR (File name: request.csr) to Sectigo to obtain the SSL certificate.

Note: Keep the private.key file secure. It will be required during installation.

 

Step 2: Prepare the Certificate File for IceWarp

1. Extract the contents of the ZIP file downloaded from Sectigo.
2. Locate the main certificate file and rename its extension from .crt or .cer to .pem.
3. Open a new Notepad (or any plain text editor).
4. Paste the certificate contents in the following order:
1. Main Certificate (.pem)
2. Private Key (private.key generated earlier)
3. CA Bundle provided by Sectigo
   (usually 2–3 certificates forming the full chain)

1. Ensure there are no extra spaces or text between the certificate blocks.
2. Or use the following commands:

Linux: cat file1 file 2 > file 3

Microsoft: type file 1 file 2 > file 3

File 3 is the system generated file that will have the concatenated certificates in the correct order.

7. Save the file with a .txt extension (for example: icewarp_ssl.txt).

 

Step 3: Import the Certificate into IceWarp

1. Open the IceWarp Server Console.
2. Navigate to Certificates.
3. Click Create / Add Certificate.
4. Select Add existing certificate.

5. Upload the .txt file created in Step 2.
6. The certificate will now appear in the certificate list.
7. Right-click the certificate and select Set as Default to bind it to the server.

 

Step 4: Restart IceWarp Services

1. Restart the IceWarp server or the relevant IceWarp services.
2. This ensures the newly installed SSL certificate is applied correctly.

 

Verification

After restart:

• Access IceWarp services (webmail, SMTP, IMAP, POP, etc.)
• Verify the certificate using a browser or SSL testing tool
• Confirm the correct certificate and full chain are presented

 

Common Issues & Tips

• Ensure the certificate order is correct (Certificate → Private Key → CA Bundle).
• Make sure the certificate Common Name (CN) matches the server hostname.
• If the certificate does not appear, recheck formatting and file contents.

Related Articles:
Tags: