Knowledge Base

How Do I Install an SSL Certificate in IceWarp?

Updated on August 14, 2026

Overview

By the end of this article, you will have a working SSL certificate installed and set as the default certificate on your IceWarp Mail Server. The article covers four stages in order: generating a private key and a Certificate Signing Request (CSR) with OpenSSL, preparing a single combined certificate file that contains the certificate, the private key, and the Certificate Authority (CA) bundle, importing that file through the IceWarp Server Console, and restarting the IceWarp services so the certificate takes effect. It then explains how to verify the installation and how to resolve the most common issues, such as an incorrect certificate order or a Common Name (CN) that does not match the server hostname.

Prerequisites

Before you begin, confirm that you have the following:

OpenSSL installed on the server or on a local machine.
Administrator access to the IceWarp Server Console.
Permission to restart the IceWarp server or its individual services.
Your issued certificate files from Sectigo, delivered as a compressed ZIP archive.

Steps to Install an SSL Certificate in IceWarp

Step 1: Generate a private key and Certificate Signing Request (CSR) using OpenSSL

A Certificate Signing Request (CSR) is the encoded request file that Sectigo uses to issue your certificate. To create one:

Open a command prompt or terminal on the server.
Run the following command to generate a 3072-bit Rivest–Shamir–Adleman (RSA) private key and a matching CSR:
```
openssl req -newkey rsa:3072 -nodes -keyout private.key -out request.csr
```
Enter the certificate details when prompted, including the Common Name (CN), which must match the hostname clients will use to reach the server.
Submit the generated request file, request.csr, to Sectigo to obtain your SSL certificate.

Important: Keep the private.key file in a secure location. It is required in Step 2, and Sectigo cannot recover it if it is lost.

Step 2: Prepare the combined certificate file for IceWarp

IceWarp expects a single plain-text file that contains the certificate, the private key, and the Certificate Authority (CA) bundle in one specific order. To build that file:

Extract the contents of the compressed ZIP archive downloaded from Sectigo.
Rename the main certificate file extension from .crt or .cer to .pem.
Open a plain text editor, such as Notepad.
Paste the contents in exactly this order:

Main certificate (.pem)
Private key (private.key, generated in Step 1)
Certificate Authority (CA) bundle provided by Sectigo, usually two or three certificates that form the full chain

Confirm there are no extra spaces, blank characters, or additional text between the certificate blocks.
Save the file with a .txt extension, for example icewarp_ssl.txt.

Alternatively, combine the files from the command line. In both commands below, file3 is the newly created file that holds the concatenated certificates in the correct order:

Operating System	Command
Linux	`cat file1 file2 > file3`
Windows	`type file1 file2 > file3`

Step 3: Import the combined certificate file into the IceWarp Server Console

The IceWarp Server Console is the administration interface where certificates are stored and assigned. To import the file you prepared:

Open the IceWarp Server Console.
Navigate to Certificates.
Click Create / Add Certificate.
Select Add existing certificate.
Upload the .txt file you created in Step 2, which contains the certificate, private key, and Certificate Authority (CA) bundle.
Confirm that the certificate now appears in the certificate list.
Right-click the certificate and select Set as Default to bind it to the server.

Figure 1: IceWarp Server Console displaying the Add Existing Certificate option selected in the Create/Add Certificate wizard, used to import an existing SSL certificate and certificate chain into the server.

Before publishing, check this screenshot for visible hostnames, account names, email addresses, or certificate serial numbers, and mask anything that identifies a real server or customer.

Step 4: Restart the IceWarp services

Restart the IceWarp server, or restart the individual IceWarp services in use, so that the newly installed SSL certificate is loaded and applied.

How to Verify Success

After the IceWarp services have restarted, confirm the installation:

Connect to each IceWarp service in use — webmail, Simple Mail Transfer Protocol (SMTP), Internet Message Access Protocol (IMAP), and Post Office Protocol (POP) — and confirm the connection is secured.
Open the webmail address in a browser over HTTPS and check that no certificate warning appears.
Use a browser certificate viewer or an SSL testing tool to confirm the correct certificate is presented and the full chain, including the Certificate Authority (CA) bundle, is complete.

Troubleshooting

Issue: The certificate does not appear in the certificate list after upload

Cause: The combined file is formatted incorrectly, or a certificate block is missing.

Solution: Reopen the file and confirm the order is certificate, then private key, then Certificate Authority (CA) bundle, with no extra spaces or text between the blocks.