Install a certificate you bought elsewhere

For organisation-validated and extended-validation certificates required by a policy.

Free automatic certificates suit almost every site. Some organisations are required by policy to use an OV or EV certificate from a specific authority. Those can be uploaded.

What you need

• The certificate, PEM encoded.
• The full intermediate chain, in order, leaf first.
• The private key, unencrypted, matching the certificate.

Upload it

1. Generate a CSR

   Sites → Domains → SSL → Generate CSR, or use your own key pair.

2. Complete validation with the authority

   OV and EV involve paperwork and can take several days.

3. Upload certificate, chain and key

   They are validated before installation; a mismatch is rejected with the reason.

4. Set a renewal reminder

   Uploaded certificates are not renewed automatically. Diarise the expiry date.

# confirm the key matches the certificate
openssl x509 -noout -modulus -in cert.pem | openssl md5
openssl rsa  -noout -modulus -in key.pem  | openssl md5