How to install an SSL certificate

For the great majority of websites, installing a certificate is not something you actually have to do. A free certificate is included on every hosting plan and is issued automatically as soon as your domain points at your hosting account — there is no order to place, no file to generate, and no separate product to buy. This guide covers how to confirm that has happened, what stops it happening, and the smaller number of cases where you do need to install something yourself.

Why it might not have appeared yet

Automatic issuance depends on one thing: the domain has to be resolving to your hosting account before a certificate can be requested for it. If you have just added a domain, changed its nameservers, or moved it from another host, there is a window where DNS is still catching up. A certificate cannot be issued for a domain pointing somewhere else, so during that window the site will either show no certificate at all or an error about the connection not being private.

Checking the certificate in your control panel

Sign in to your control panel and open the SSL section for the domain in question. It will show whether a certificate is currently active, which domain names it covers, and its expiry date. This is the fastest way to confirm what is actually installed, rather than relying on what a browser happens to be showing you at that moment — browsers cache aggressively and can display an old state.

If the domain is listed but no certificate has been issued, the panel usually gives you the option to trigger the issuance check manually rather than waiting for the next scheduled attempt. Doing that after DNS has settled is often enough to resolve it immediately.

Confirming it from outside your own browser

Your own browser is the least reliable way to check, because it remembers the last certificate it saw for a domain. To check properly:

• Open the site in a private or incognito window, which starts without cached certificate state.
• Load it over a different network — mobile data rather than your home or office connection — to rule out a local DNS cache showing you an old answer.
• Click the padlock (or the icon your browser uses for a secure connection) and view the certificate details. It should list your domain and show a valid date range.

Installing a certificate you bought separately

If you specifically need organisation validation, extended validation, or a wildcard certificate covering many subdomains at once, you may have bought that from a certificate authority rather than using the free one. In that case you will have three pieces to install: the certificate itself, its private key, and an intermediate certificate chain supplied by the authority.

1. Gather all three files

   The certificate, the private key generated when you created the certificate signing request, and the chain (sometimes called the CA bundle or intermediate certificate) provided by the issuing authority. Missing the chain is the single most common reason an otherwise valid certificate still shows warnings in some browsers.

2. Open the SSL section of your control panel

   Look for an option to install a custom or externally issued certificate, separate from the automatic free one.

3. Paste each piece into its matching field

   Certificate, private key and chain each go in their own box. Paste the full contents including the begin and end marker lines, and do not add or remove any line breaks within the block.

4. Save and verify

   Once saved, check the site exactly as described above — private window, different network, and inspect the certificate details to confirm it shows the organisation information you paid for.

After the certificate is active

Having a certificate installed is not the same as every visitor actually using it. Until you take the next step, your site is usually still reachable over plain, unencrypted HTTP as well as HTTPS, and a visitor who types the address without https://, or follows an old link, will land on the unencrypted version. Forcing HTTPS on your site covers redirecting every request to the secure version so that never happens.

It is also worth checking your site immediately afterwards for mixed content warnings — pages that load correctly over HTTPS but still pull in an image, script or stylesheet over plain HTTP, which shows as a broken padlock even though the certificate itself is perfectly valid.

Renewal is automatic too

Free certificates renew themselves in the background as long as the domain keeps pointing at your hosting account, so there is nothing to schedule. A certificate you purchased separately for organisation or extended validation is the exception — those are issued for a fixed term and need renewing before they expire, covered in how to renew an SSL certificate.