How to Install an SSL Certificate on cPanel

How do I install an SSL certificate on cPanel?

To install an SSL certificate on cPanel, go to Security → SSL/TLS → Manage SSL sites, choose the domain, paste your certificate, click Autofill by Certificate so cPanel finds the matching private key, check that the Certificate Authority Bundle (CABUNDLE) field holds the intermediate certificate, and click Install Certificate. cPanel updates the web server for you; there is nothing to restart.

This guide is the cPanel-specific part of our overview on how to install an SSL certificate. It works the same for Sectigo, Comodo, DigiCert, GeoTrust, Thawte and RapidSSL certificates. Menu names can differ slightly between cPanel versions and hosting themes.

Item	What you need
Access	cPanel login for the account that hosts the domain
Certificate	The .crt file from your CA (text starting with -----BEGIN CERTIFICATE-----)
CA bundle	The intermediate file, often named .ca-bundle
Private key	Stored in cPanel if you made the CSR there; otherwise your own copy
Command line	Not needed

Step-by-step: install SSL certificate in cPanel

1. Create the CSR in cPanel (recommended)

If you have not ordered yet, create the CSR (certificate signing request) under SSL/TLS → Certificate Signing Requests (CSR). cPanel then stores the private key in your account, and the autofill step below finds it on its own. If you prefer to create the CSR elsewhere, for example with our CSR generator, keep the private key; you will paste it in step 3.

2. Open Manage SSL sites and paste the certificate

1. Log in to cPanel and open Security → SSL/TLS.
2. Under Install and Manage SSL for your site (HTTPS), click Manage SSL sites.
3. Select the domain from the drop-down.
4. Open your .crt file in a text editor and paste the complete content into Certificate (CRT).

3. Fill in the key and CA bundle

1. Click Autofill by Certificate. cPanel searches your account for the private key that matches the certificate and fills in Private Key (KEY).
2. If the key field stays empty, paste your private key manually.
3. Check Certificate Authority Bundle (CABUNDLE). If cPanel did not fetch it, paste the content of the .ca-bundle file from your CA.

The CA bundle completes the certificate chain between your certificate and the browser’s trusted root. Without it, the site may work on your desktop and fail on phones.

4. Install

Click Install Certificate. cPanel confirms which domains the certificate now covers and reloads the web server itself.

Tip: Installing a Comodo SSL certificate in cPanel works exactly like this. Comodo-branded certificates (PositiveSSL, EssentialSSL, InstantSSL) are issued by Sectigo, formerly Comodo CA, and arrive with a .ca-bundle file for the CABUNDLE field.

Free AutoSSL vs. your own certificate in cPanel

Many hosts enable AutoSSL, a cPanel feature that installs free domain-validated certificates automatically. By default, AutoSSL does not renew or replace a certificate it did not issue, so your paid OV, EV or DV certificate stays in place. Your host can change this in WHM with the option Allow AutoSSL to replace invalid or expiring non-AutoSSL certificates; if that option is on, AutoSSL may swap in a free certificate once yours is close to expiry.

Whether a free AutoSSL certificate is enough for your site is a separate decision, covered in free vs paid SSL certificates.

Where does cPanel store SSL certificate files?

cPanel keeps the keys, certificates and CSRs of each account in the ssl folder of the account’s home directory, and the certificates actually installed for each domain in a server-wide directory that only root can read. You normally manage both through the SSL/TLS interface, not by editing files.

What	Location	Who can see it
Private keys	/home/USERNAME/ssl/keys/	Account user (File Manager), SSL/TLS → Private Keys
Certificates	/home/USERNAME/ssl/certs/	Account user, SSL/TLS → Certificates (CRT)
CSRs	/home/USERNAME/ssl/csrs/	Account user, SSL/TLS → CSR
Installed certificate per domain	/var/cpanel/ssl/apache_tls/DOMAIN/	Server root / WHM only

For Apache, Nginx, IIS, Java keystores and desktops, see where certificates are stored on other systems.

How do I host several SSL sites on one cPanel server?

Install a certificate for each domain in Manage SSL sites; cPanel uses SNI (Server Name Indication, the hostname the browser sends at the start of the TLS handshake) to serve the right certificate, so all sites can share one IP address. You do not need a dedicated IP for HTTPS.

Every main domain, addon domain and subdomain is its own SSL site in cPanel. One certificate can cover several of them if it lists those names, such as a multi-domain or wildcard certificate: install it once per domain, and cPanel’s Autofill matches it each time. On a server you manage, WHM → Manage SSL Hosts shows which sites require SNI and which one is the primary site on each IP.

cPanel SSL certificate expired: how to replace it

Install the renewed certificate over the old one in Manage SSL sites; cPanel replaces the installed certificate for that domain at once, with no restart. If the expired certificate was an AutoSSL certificate, check SSL/TLS Status in cPanel for the reason the automatic renewal failed, which is usually a DNS record that no longer points to the server. As of October 2026, publicly trusted TLS certificates last at most 200 days, falling to 100 days on 15 March 2027 under CA/Browser Forum ballot SC-081. How to renew an SSL certificate in time is covered in its own guide.

Common cPanel SSL errors

Error or symptom	Likely cause	Fix
Autofill leaves the key field empty	CSR and key were made outside this account	Paste your private key manually
“The certificate does not match the private key”	Key from a different CSR	Use the matching key or reissue with a new CSR
Works on desktop, fails on mobile	CABUNDLE field empty	Paste the CA bundle and reinstall
www works, bare domain fails (or vice versa)	Certificate covers only one name	Check the names on the certificate; reissue with both
Paid certificate replaced by a free one	AutoSSL replacement option enabled	Ask your host to disable it, then reinstall

After every change, test the live site with our SSL checker. It shows the certificate the server actually sends, the chain and the expiry date.