How to Get an SSL Certificate: Step by Step

How to get an SSL certificate: the short answer

To get an SSL certificate, choose the type that fits your site, buy it from a certificate authority or reseller, generate a certificate signing request (CSR), prove you control the domain, then install the issued certificate on your server. For a domain validated certificate, you only need access to your domain’s email, DNS or website files. Organization validation adds checks on your company.

The process is the same whether your site runs on shared hosting, a VPS or a cloud load balancer. Only the place where you create the CSR and install the certificate changes.

An SSL certificate is a signed data file that binds your domain name to a cryptographic key, so browsers can set up an encrypted HTTPS connection and show the padlock. If you want the background first, read what an SSL certificate is; this guide focuses on how to get one.

What you need	Why
A registered domain name	Public certificates are issued only for real, public domains
Access to DNS, a domain email address or the web root	To prove domain control during validation
Access to your hosting panel or server	To create the CSR and install the certificate
Company registration details (OV/EV only)	The CA verifies your organization
A list of every hostname to protect	Decides single-domain, wildcard or multi-domain

How do I get an SSL certificate for my website? Six steps

Step 1: Choose the right certificate

Start with your hostname list. One site on one domain needs a single-domain certificate. Many subdomains point to a wildcard, and several domains to a multi-domain certificate. If you are not sure, our guide on which SSL certificate you need walks through common setups.

Then choose the validation level. domain validated (DV) SSL checks only domain control and suits most blogs and brochure sites. organization validated (OV) SSL also verifies your company and puts its name in the certificate details. Encryption strength is the same for both.

Step 2: Buy the certificate

Add the certificate to your cart, choose a plan term and check out. At BUY-SSL.com, a 1-, 2- or 3-year option is a plan term: you can reissue during the term, and each issued certificate follows the industry’s maximum lifetime (200 days as of October 2026). You can compare all SSL certificates before you decide.

You can buy directly from a certificate authority, from a reseller or through your web host. The trade-offs between those channels are covered in where to buy SSL certificates.

During checkout you create an account. That account is where you later paste the CSR, track validation, download the certificate and start reissues, so use an email address your team can access long term.

Tip: Buying does not issue the certificate yet. Issuance starts after you submit a CSR and complete validation, so set aside time for steps 3–5.

Step 3: Generate a CSR

A CSR (certificate signing request) is a small block of encoded text that carries your public key and the domain name to be certified. Creating it also creates a private key, which stays on your server and should never be emailed or shared.

Most hosting panels such as cPanel and Plesk generate the CSR for you. On your own server, you can use OpenSSL or our CSR generator, which also explains each field.

Step 4: Submit the CSR and pick a validation method

Open the order in your account, paste the CSR and confirm the hostnames. For DV, choose how you will prove domain control:

• Email: approve a link sent to an address such as admin@ or the domain owner’s address.
• DNS: add a TXT or CNAME record the CA provides.
• HTTP file: place a file at a set path on your website.

Step 5: Complete validation

The certificate authority checks the proof you chose. For DV, that is usually the only check. OV adds verification of your organization in official registries and a phone call, and EV adds further checks under the EV Guidelines. Keep your legal company name, registered address and a reachable phone number ready so the CA can match them. What each check involves and how long it tends to take is explained in how SSL validation works.

Step 6: Install the certificate and test it

Once issued, you receive the certificate file plus the intermediate certificates (the chain that links your certificate to a trusted root). Upload both to your server or hosting panel and assign them to your site. Our step-by-step guides show how to install an SSL certificate on cPanel, Apache, Nginx, IIS and other platforms.

Then run your domain through our SSL checker. It confirms the certificate matches the hostname, the chain is complete and the dates are valid. Finally, redirect all HTTP traffic to HTTPS and update hard-coded http:// links.

Where you create the CSR and install the certificate

Steps 3 and 6 happen in the same place: wherever your site’s HTTPS connection ends. Find your setup below.

Your setup	Create the CSR in	Install the certificate in
Shared hosting with cPanel or Plesk	The panel’s SSL/TLS section	The same section
Linux server with Apache or Nginx	OpenSSL on the server or a CSR tool	The web server’s configuration files
Windows server with IIS	IIS Manager (Server Certificates)	IIS Manager, then bind it to the site
CDN or cloud load balancer	Your server or a CSR tool	The provider’s certificate settings
Fully managed website builder	Usually not possible	The platform provides the certificate itself

If your platform manages certificates for you, a purchased certificate may not be usable there. Check whether you can upload a custom certificate before you buy.

How to purchase an SSL certificate without common mistakes

Most delays come from small mismatches between the order, the CSR and the server. Check this table before you submit.

Mistake	What happens	How to avoid it
Wrong common name in the CSR	Certificate does not match the site	Use the exact hostname visitors type
Forgetting subdomains	Browser warning on uncovered names	List every hostname before you buy
No access to admin@ email	DV approval email never arrives	Use DNS or HTTP file validation instead
Lost private key	Certificate cannot be installed	Back up the key securely; reissue with a new CSR if lost
Missing intermediate certificate	Errors on some browsers and devices	Install the full chain the CA supplies
Company details differ from registry (OV)	Validation stalls	Use your legal name and registered address

Can I get an SSL certificate for free?

Yes. Many hosts include a free DV certificate, and Let’s Encrypt issues free DV certificates through automated clients. Paid certificates add options such as OV/EV validation, wildcard and multi-domain support, and human support – see free vs paid SSL certificates for the full comparison.

What happens after you get your SSL certificate?

Each issued certificate has a fixed end date. As of October 2026 the maximum is 200 days, and it falls to 100 days in March 2027 and 47 days in March 2029, so replacing certificates becomes a routine task. The schedule is explained in how long SSL certificates are valid.

• Note the expiry date and set a reminder well ahead of it.
• Keep the private key and CSR details stored securely.
• Reissue during your plan term whenever the certificate nears expiry or your hostnames change.
• Re-run the SSL check after every replacement.