If you bought an SSL certificate from a CA like Sectigo, DigiCert, or GoDaddy instead of relying on cPanel's free AutoSSL, you can't just drop the files in and hope. cPanel needs the certificate, the private key, and usually a CA bundle installed in the right place through SSL/TLS Manager — and if you skip the CSR step or paste the wrong file into the wrong box, you'll end up with a "certificate does not match" error or a site that still shows the old cert. Here's the process end to end.
When You Need This (Instead of AutoSSL)
AutoSSL is fine for most sites — it's free, it renews itself, and it just works. You'd go the manual route instead when:
- You bought a paid certificate (EV, OV, or a specific brand your compliance team requires)
- You need a certificate that covers a domain AutoSSL can't validate automatically (behind Cloudflare in certain modes, or an internal-only host)
- A client or auditor specifically asked for a named-CA certificate, not a Let's Encrypt one
- You're migrating an existing paid cert from another host to a cPanel account on SkyServer
Step 1: Generate a CSR (Certificate Signing Request)
The CSR is what you hand to the certificate authority when you buy the cert. It's generated from a private key that stays on your server — never share the private key itself, only the CSR.
- Log in to cPanel and open SSL/TLS under the Security section
- Click Generate, view, upload, or delete SSL certificate signing requests
- Fill in the domain (use the exact domain, e.g.
example.com, or*.example.comfor a wildcard) - Fill in City, State, Country, and Company details accurately — CAs check these against your business registration for OV/EV certs
- Click Generate
cPanel will show you the CSR text block and generate a matching private key automatically, which it stores for you. Copy the entire CSR block, including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines, and paste it into your CA's order form.
If you already have a CSR and key generated elsewhere (say, via OpenSSL on your own machine), you can skip cPanel's generator and upload your own CSR on the same screen instead. Just make sure you keep the private key that matches it — you'll need it in Step 3.
Step 2: Complete Domain Validation With Your CA
Once you submit the CSR, the certificate authority will ask you to prove you control the domain. This is usually one of three methods:
- Email validation — a confirmation link sent to admin@, webmaster@, or postmaster@ your domain
- DNS validation — add a TXT record the CA gives you through cPanel's Zone Editor
- HTTP file validation — upload a small verification file to a specific path via File Manager
DNS validation is usually the most reliable, since it doesn't depend on a working mailbox on the domain you're trying to secure. Once validation completes, the CA will email you the issued certificate — usually as a .crt file — plus a separate CA bundle (intermediate certificate chain) file.
Step 3: Install the Certificate in cPanel
Back in SSL/TLS → Install and Manage SSL for your site (HTTPS):
- Select the domain you're installing the certificate for
- Paste the certificate contents into the Certificate (CRT) box — open the
.crtfile your CA sent in a plain text editor and paste the whole thing - The Private Key (KEY) box usually auto-fills if cPanel generated the CSR for you. If it's blank, paste in the private key you saved when you generated (or brought) the CSR
- Paste the CA bundle / intermediate certificate into the Certificate Authority Bundle (CABUNDLE) box — this is the file that chains your cert back to a root CA that browsers trust
- Click Install Certificate
cPanel will validate that the certificate, key, and domain all match before it lets you install. If they don't match, you'll get an error at this step rather than a broken site — which is the whole point of doing it this way instead of editing Apache config by hand.
Common Errors and What They Actually Mean
| Error | Cause | Fix |
|---|---|---|
| "The certificate you are trying to install is not valid" | Certificate and private key don't match — often because a new CSR was generated after the CA issued the cert | Re-download the cert against the correct CSR, or regenerate the CSR and re-submit to the CA |
| Browser still shows the old certificate | Browser or CDN cache, or the cert installed on the wrong domain/subdomain in a multi-domain account | Hard refresh, check via openssl s_client -connect example.com:443, confirm you installed on the right vhost |
| "Incomplete certificate chain" warning on SSL checkers | CABUNDLE field left empty or wrong intermediate pasted | Re-download the correct intermediate bundle from your CA's certificate download page and paste it in |
| Cert works on www but not the bare domain (or vice versa) | CSR only requested a single hostname, not both | Order a cert that covers both, or add a SAN (Subject Alternative Name) covering the second hostname |
Verify It Actually Installed Correctly
Don't just trust the padlock icon — check it properly:
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -issuer -datesThis shows you the actual issuer (should be your CA, not "Let's Encrypt" if you just paid for something else) and the expiry date. You can also run the domain through an online SSL checker to confirm the chain is complete and there are no mixed warnings.
Prevention: Track Expiry Yourself
Paid certificates don't auto-renew the way AutoSSL does. Set a calendar reminder 30 days before expiry — most CAs will email you too, but those emails land in spam often enough that you shouldn't rely on them alone. If you're tired of tracking manual renewals every year, ask whether AutoSSL (free, auto-renewing) actually meets your requirement before buying another paid cert — for the majority of sites it does the same job with zero maintenance.
Frequently Asked Questions
Can I install a wildcard SSL certificate the same way?
Yes — generate the CSR for *.example.com instead of a single hostname, complete DNS validation (wildcards almost always require DNS validation, not email or HTTP), and install the issued cert exactly as described above. It'll cover all first-level subdomains under that domain.
What happens if I lose the private key generated by cPanel?
If cPanel generated the key and you never exported it, it's usually still stored under that domain's SSL records in WHM — check SSL/TLS → Private Keys (KEY). If it's genuinely gone, you'll need to generate a fresh CSR and re-issue the certificate with your CA, since a certificate is useless without its matching key.
Do I need the CA bundle if my site already works without it?
Yes. A site can look fine in your own browser (which may cache or fetch the intermediate cert separately) while failing for other visitors or automated tools that don't. Always install the full CA bundle — incomplete chains are one of the most common causes of "works for me, broken for everyone else" SSL reports.
Can I move a paid certificate from another host to SkyServer?
Yes, as long as you still have the private key. Export the certificate, CA bundle, and private key from the old host, then paste all three into the Install SSL screen on your SkyServer cPanel account as described in Step 3 — you don't need to generate a new CSR if you're reusing the same key and cert.
Will installing a custom certificate break AutoSSL for other domains on the account?
No. AutoSSL and manually installed certificates are managed per-domain. Installing a custom cert on one domain won't affect AutoSSL's behavior on other domains or subdomains in the same cPanel account, though cPanel will stop trying to auto-renew that specific domain since it now has a non-AutoSSL certificate installed.
