Free tools Windows power users keep installed
One-click scans. No signup required.
Install a commercial SSL/TLS certificate by keeping the private key created with its CSR, downloading the issued server certificate and the CA’s intermediate bundle, then configuring all three in the server platform that terminates HTTPS. The server certificate must match the private key, the hostname must be covered by the certificate, and the intermediate certificates must be installed or served in the order your platform expects. Finish by reloading the service and testing the live endpoint from outside the server.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before installation
A certificate authority (CA) does not send a complete, ready-to-paste website configuration. It issues a public server certificate after validation, while your server must retain the private key that was generated when the certificate signing request (CSR) was created. The CSR is the formal request your server sends to the CA to begin issuance.
As an Amazon Associate I earn from qualifying purchases.
- Matching private key: Keep the key generated with the CSR on the server or in an approved secure key store. Never email it, publish it, or paste it into a ticket or chat.
- Issued server certificate: This is usually a PEM-encoded certificate file for the hostname or hostnames you validated.
- CA intermediate bundle: The bundle lets clients build a path from your server certificate to a trusted root. It is often called a chain, intermediate certificate, or CA bundle.
- Hostname coverage: Check the certificate’s Subject Alternative Name (SAN) entries. Every hostname the virtual host serves must be covered, including a
wwwname if it is used separately. - Administrative access: You need permission to edit the HTTPS configuration, certificate stores, virtual-host bindings, or hosting-control-panel fields.
- A maintenance window or reload plan: Most platforms require a configuration reload or service restart before the new certificate is served.
A wildcard certificate can cover multiple hosts within its permitted wildcard scope, while a multi-domain (SAN) certificate can list distinct names. Neither option removes the need to select the correct virtual host or SNI binding.
The complete installation workflow
- Create or locate the CSR and private key. If the CSR was generated on the server, keep the resulting key in place. If another system generated it, transfer the key only through a protected administrative channel and verify its permissions before installation.
- Complete the CA’s validation. Depending on the certificate type, the CA may validate control of a domain or verify organizational details. Wait for issuance before replacing a working certificate.
- Download both certificate parts. Obtain the issued server certificate and every intermediate certificate the CA supplies. A server certificate by itself is not a complete chain.
- Check names and dates. Confirm that the SAN list covers the exact names clients will request and note the validity period and issuer shown by the CA.
- Prove the key pair matches. The public key in the issued certificate must correspond to the private key used for the CSR. A certificate issued from a different CSR cannot be paired with that key.
- Place the files in the platform’s configuration. cPanel/WHM uses separate certificate, key, and CA-bundle fields; Nginx uses certificate-file directives; IIS uses certificate stores and site bindings.
- Build the chain in the required order. For Nginx, put the server certificate first and the intermediate certificates after it. Other platforms may store intermediates separately, but they still need to be available to the server when it sends the TLS chain.
- Validate, reload, and test. Run the platform’s configuration check if available, reload or restart the service, then test the public hostname from a browser and an independent TLS diagnostic service.
Choose the procedure for your server
| Platform | Where the certificate is configured | Automation versus manual work | Important operational concern |
|---|---|---|---|
| cPanel/WHM | SSL/TLS management and WHM’s certificate-installation page | Manual installation accepts an issued certificate, private key, and optional CA bundle; AutoSSL is a separate automated provider workflow | Paste each item into its matching field and select the correct domain or SNI host |
| Nginx | ssl_certificate and ssl_certificate_key in the HTTPS server block |
File-based and manual unless your deployment tooling automates renewals | The combined certificate file must start with the server certificate; the master process must read the restricted private key |
| IIS | Windows certificate stores, intermediate stores, and IIS HTTPS bindings | Import and binding are manual unless Windows or deployment software manages them | Install intermediates so IIS can construct and send a chain that clients can validate |
Install a commercial certificate in cPanel or WHM
1. Open the certificate installation page
In WHM, open the SSL/TLS certificate installation area. The current interface can browse certificates already stored on the server, find a certificate by domain, or accept pasted values. In cPanel, the SSL/TLS interface manages private keys, CSRs, and certificates for the account.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
2. Use the safest matching method
If the certificate is already stored, use Browse Certificates. If the certificate includes a domain that cPanel can identify, use Autofill by Domain. These options reduce copy-and-paste errors but do not replace checking the hostname and key pair.
When autofill cannot find the right objects, choose manual entry and supply the files in their corresponding fields:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Certificate (CRT): paste the issued server certificate.
- Private Key (KEY): paste the key generated for the CSR. Do not use a key from another request.
- Certificate Authority Bundle (CABUNDLE): paste the CA’s intermediate bundle when one is supplied.
3. Install and select the correct domain
Click Install, then confirm that the certificate is assigned to the intended domain and service. If the account hosts several domains, check the SNI selection rather than assuming the first matching name is the one clients will receive.
4. Account for wildcard and multi-domain certificates
cPanel supports multiple certificates through SNI and can use wildcard or multi-domain certificates. The certificate still has to list every requested hostname, and each virtual host must point to the intended certificate.
5. Keep manual installation separate from AutoSSL
Manage AutoSSL can renew certificates through an automated provider workflow. That process is different from manually installing a certificate that you purchased and received from a commercial CA. Do not treat an AutoSSL renewal setting as proof that your manually installed certificate will renew automatically.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Install the certificate on Nginx
1. Prepare the certificate files
Nginx needs a public certificate file and a private key file. Keep the key readable by the Nginx master process but restrict access so ordinary users cannot read it. If the CA supplied a server certificate and intermediate bundle as separate files, create a chained certificate file with the server certificate first and the intermediates immediately after it.
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /etc/nginx/ssl/www.example.com.chained.crt;
ssl_certificate_key /etc/nginx/ssl/www.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
}Replace the example hostname and paths with the names and locations used by your server. The certificate file is public configuration data; the key file is a secure secret.
2. Put the certificate before the intermediates
The order in the chained file matters. Nginx expects its own server certificate first, followed by the chained certificates. If an intermediate appears first, Nginx may try to use that first certificate with your private key, produce a key-values-mismatch error, and refuse to start.
3. Configure the HTTPS virtual host
Add or update the HTTPS server block for the requested hostname. Confirm that the server_name, certificate path, and key path belong to the same site. On a server with several HTTPS sites, make sure the SNI virtual-host selection cannot route the request to a default certificate.
4. Check and reload safely
Use Nginx’s configuration-test facility before reloading. If the test succeeds, reload the service so existing connections can finish while new connections receive the new certificate. A full restart is only needed when your operating procedure requires it.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
5. Confirm key protection
Use restrictive ownership and permissions for the key while retaining read access for the Nginx master process. Back up the key only in an encrypted, access-controlled location; losing it means you cannot use the issued certificate without generating a new CSR and certificate.
Install the certificate on IIS
1. Import the issued certificate with its private key
IIS must have access to the private key associated with the issued certificate. Import the certificate into the appropriate Windows certificate store using the certificate-management tools available on your Windows Server and IIS release. The exact import and binding screens differ between releases, so follow the labels shown by the installed version rather than assuming a particular wizard layout.
2. Install the CA intermediates
Place the intermediate certificates supplied by the CA in the intermediate certification-authorities store. An intermediate helps establish that the server certificate was ultimately issued by a trusted root. IIS uses this chain when deciding what to send to clients during TLS setup.
3. Bind HTTPS to the site
In IIS Manager, edit the site’s HTTPS binding and select the imported certificate. Set the intended IP address, port, and host name, and enable the host-name/SNI option when multiple HTTPS sites share an address. A correct certificate in the store can still be unused if the binding points to an older certificate or to another site.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →4. Recycle or reload according to your change procedure
Apply the binding change and recycle the affected site or services according to your Windows administration policy. Then test the public hostname, not only the local server, because a proxy, load balancer, or alternate IIS binding may terminate TLS elsewhere.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
How to verify the installation
Check the certificate served to a browser
Open each production hostname over HTTPS and inspect the certificate details. Confirm the subject/SAN names, issuer, validity dates, and the displayed chain. Test both the bare domain and any separate www, API, or administrative names that are meant to use the certificate.
Use an external TLS diagnostic
An external diagnostic checks what an ordinary Internet client receives rather than what is present on disk. Verify that it reports the expected certificate, a complete chain, the intended protocol configuration, and no hostname mismatch. Run the check after every reload and after any proxy or load-balancer change.
Verify the private-key match
Compare the public-key identity in the certificate with the key used by the service. A mismatch usually means that the certificate came from a different CSR, that a virtual host is loading another certificate, or that a file was replaced during deployment. Correct the pairing before troubleshooting browsers; no chain change can repair a mismatched key.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchCheck the endpoint that users actually reach
Testing only localhost can miss DNS, SNI, reverse-proxy, or load-balancer mistakes. Query the public DNS name from a network outside the server and repeat the check for every hostname covered by the certificate.
Troubleshooting common failures
The browser reports an incomplete certificate chain
Install or serve the CA-provided intermediate bundle. Clients cannot be expected to have every intermediate cached. On Nginx, rebuild the chained file with the server certificate first and the intermediates afterward. On IIS, confirm that the intermediates are in the correct intermediate store and available to the site. In cPanel, paste the CA bundle into the CABUNDLE field instead of appending it to the private-key field.
Nginx will not start or reports a key mismatch
First inspect the combined certificate file: the issued server certificate must be the first certificate, not an intermediate. Next verify that the configured private key was generated for the CSR used to obtain that certificate. Finally check that the HTTPS server block points to the files you edited, rather than to an older path or a different virtual host.
cPanel refuses the installation
Use manual entry when Autofill by Domain cannot identify the certificate. Make sure the CRT, KEY, and CABUNDLE contents are pasted into their respective fields with their complete PEM boundaries intact. Confirm that the selected domain matches a name in the certificate and that the private key belongs to the same CSR.
The wrong site receives the certificate
Check the hostname coverage, DNS target, and virtual-host/SNI selection. On cPanel, verify the domain assignment after installation. On Nginx, inspect the order and names of the server blocks. On IIS, inspect every HTTPS binding that shares the address and port. A valid certificate attached to the wrong binding is still a production outage.
Renewal was expected but did not happen
Manual installation does not automatically create a renewal job. cPanel’s AutoSSL workflow is separate from installing an already issued commercial certificate. Track the certificate’s expiry date, obtain a replacement from the CA in time, and repeat the key-pair, chain, binding, reload, and external-test checks for the renewed certificate.
The certificate appears valid on the server but fails publicly
Inspect the endpoint reached through the public hostname. A CDN, reverse proxy, load balancer, or second server may terminate HTTPS before the machine you changed. Install the certificate and chain on the actual TLS terminator, or update the routing so the request reaches the intended virtual host.
Operational practices that prevent outages
- Record which CSR produced each certificate and where its private key is stored.
- Restrict key-file permissions and keep encrypted backups under controlled access.
- Store the server certificate and intermediate bundle together with deployment notes, but never store the private key in a public repository.
- Document every hostname, wildcard scope, SAN entry, and SNI binding covered by the certificate.
- Set an expiry reminder well before the validity period ends; do not wait for a browser warning.
- After every installation or renewal, test externally for names, issuer, dates, key match, and chain completeness.
What a successful installation looks like
The live HTTPS endpoint presents the certificate issued for the requested hostname, the corresponding private key accepts the handshake, and the server supplies the CA intermediates in the platform’s required arrangement. A browser shows a trusted chain without a hostname or expiry warning, while an external diagnostic confirms that the same result is visible from the Internet. Only after those checks should the old certificate be removed.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesQuick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
