Installing your own (paid) certificate

Have you bought a certificate, for example an OV or EV certificate with your company details? Then you install it yourself in DirectAdmin. You need three things, which you get from your supplier or have created yourself:

• the private key: starts with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----;
• the certificate: starts with -----BEGIN CERTIFICATE-----;
• the intermediate certificates (CA bundle or chain) from your supplier.

Uploading the certificate

1. Go to SSL/TLS Certificates.
2. Next to DNS names without TLS certificate, click the three dots after your domain and choose Upload custom certificate. You'll land on Upload Certificate.
3. Under Hostname (1) you'll see the name the certificate is valid for.
4. Paste the private key under Private Key (2), and the certificate under Certificate (3). If you have them as files, click Insert from file: DirectAdmin will fill in the fields for you.
5. Under Certificate chain (4), click Add chain certificate and paste the intermediate certificates. If you paste a full bundle into the Certificate field, DirectAdmin will automatically place the extra certificates in the chain.
6. Leave Add to the ACME skip list ticked (it's on by default). Otherwise, DirectAdmin may later replace your certificate with a free Let's Encrypt certificate.
7. Click UPLOAD.

If something's wrong, DirectAdmin may show a message such as Key is empty or not valid or Certificate is empty or not valid. Check that you've pasted the entire text, including the BEGIN and END lines, and that the key and certificate match. Don't enable Allow invalid certificate: this is only for testing.

After uploading

• The certificate appears in the Certificate list, along with its expiry date.
• A purchased certificate is not renewed automatically. Note the expiry date in your calendar and upload the new certificate in good time.
• Check your site via https and redirect visitors to https (see Always redirect visitors to https).

Tip: Do you need to create a CSR (certificate signing request) for your application with the supplier? You can do this at the supplier or on your own computer. Keep the private key that goes with it safe: without this key, you won't be able to install the certificate.