On this page
Installing an SSL certificate encrypts data between your visitors’ browsers and your web server, turning HTTP into HTTPS. You’ll recognise such a site from the padlock icon that signals an encrypted/authenticated connection. (Note: HTTPS doesn’t guarantee that the website itself is safe or trustworthy).
Beyond simply securing data, making the switch to HTTPS has become a non-negotiable standard for running a successful website. For starters, search engines like Google actively use HTTPS as a ranking signal, meaning an SSL certificate can give your site a valuable SEO boost over unsecured competitors. Furthermore, modern browsers like Chrome and Firefox penalize HTTP sites by displaying glaring "Not Secure" warnings next to your URL, which can instantly erode visitor trust and drive potential customers away. If your website collects personal data, accepts passwords, or processes payments, an SSL certificate is also strictly required to meet PCI compliance standards and helps you adhere to strict data privacy regulations like GDPR.
The installation process varies by hosting platform and certificate type, but the main steps generally involve choosing the right certificate, installing it if necessary, and configuring your website to use HTTPS. This is a simple process with modern hosting platforms. With web hosting from Verpex, for example, a free AutoSSL certificate is issued and deployed within an hour of your site going live, removing the need to generate keys or upload files manually. If you’re on a platform that doesn't handle this automatically, you’ll need to complete the installation yourself through your control panel or server configuration.
Choose the right certificate
SSL certificates come in three validation levels, each suited to different use cases. In each of these cases, I would say it’s likely that many of your visitors will appreciate the peace of mind that comes with an SSL certificate, even if they’re using their own security measures like VPNs.
Domain Validation (DV) certificates confirm ownership of the domain and are sufficient for blogs, portfolios, and small business sites.
Organization Validation (OV) certificates add business registration checks and display company details in the certificate info.
Extended Validation (EV) certificates provide the highest trust level with rigorous checks, though browsers no longer show the green address bar that once distinguished them.
For most sites, a DV certificate (often free through Let’s Encrypt or your host) delivers the necessary security without extra cost or complexity.
Generate a Certificate Signing Request (CSR)
If you are opting for a paid certificate or using a host that doesn't offer AutoSSL, your first step before installation is generating a Certificate Signing Request (CSR). A CSR is a block of encoded text generated on your server that contains the information the Certificate Authority (CA) needs to create your SSL certificate.
To generate a CSR in cPanel, navigate to the SSL/TLS section and click on "Certificate Signing Requests (CSR)." You will be prompted to fill out specific details about your website and organization, including your domain name, city, state, country, and company name. Once generated, you will copy this block of text and provide it to your SSL vendor during the checkout process. While free certificates from authorities like Let's Encrypt are excellent for basic security, paid certificates often require a CSR and offer added benefits like dynamic trust seals, warranties, and direct customer support.
Install the certificate on your server
Installation varies depending on your hosting environment and how your certificate was issued.
If your host provides automatic SSL, you may not need to install the certificate manually. Certain hosts automatically enrol hosted domains in AutoSSL and install certificates when the domain is correctly pointed to its servers.
If you need to install a certificate manually through cPanel/WHM, go to SSL/TLS → Manage SSL Sites. Enter the certificate, private key, and CA bundle in the relevant fields, then click Install Certificate. Keep the private key secure and never share it publicly.
For other server environments, such as Nginx and Apache, follow your hosting provider’s or server software’s instructions for installing the certificate and any required intermediate certificates. Once installed, check that your website loads correctly using HTTPS before you move on to forcing HTTPS.
Installing SSL in CyberPanel
If your host runs CyberPanel rather than cPanel, the process is different in one important way: CyberPanel sits on top of OpenLiteSpeed or LiteSpeed Enterprise, not Apache. The panel handles issuance for you through acme.sh, and the rewrite syntax you’ll use for redirects lives inside the panel rather than in a file you edit by hand.
Issue the certificate
Before you do anything else, confirm your domain’s A record points at the CyberPanel server and that port 80 is open. Let’s Encrypt validates over HTTP, so a domain that isn’t resolving to the right IP will fail every time. This is also why sites created before DNS propagated end up with a self-signed certificate and a browser warning: the cert is there, it just isn’t trusted, and you’ll need to re-issue once the domain resolves.
To issue a certificate for an existing site:
- Log into CyberPanel (typically https://your-server-ip:8090).
- Go to SSL → Manage SSL.
- Select your domain from the dropdown.
- Click Issue SSL.
CyberPanel writes the certificate to /etc/letsencrypt/live/yourdomain.com/ and updates the site’s vhost configuration automatically, so there’s nothing to paste in. If you’re creating the site from scratch, tick SSL under Additional Features on the Create Website page and the certificate is requested as part of setup.
Two extras worth doing at the same time. SSL → Hostname SSL secures the panel itself, which stops the browser warning when you log in. SSL → MailServer SSL covers your mail hostname, which matters if you send from the same server.
If you’ve bought a paid certificate, use SSL → Manage SSL and paste the certificate and private key into the two fields provided instead of clicking Issue SSL. Include the CA bundle beneath the certificate in the same field.
Force HTTPS
CyberPanel ships a ready-made redirect template, which is the cleanest route:
- Go to Websites → List Websites and click Manage on your domain.
- Scroll to the Configurations block and open Rewrite Rules.
- Choose Force HTTP → HTTPS from the template dropdown.
- Click Save Rewrite Rules.
The rule saved is Apache-style mod_rewrite, which LiteSpeed reads natively:
RewriteEngine OnRewriteCond %{HTTPS} !=onRewriteRule ^(.*)$ https://%{SERVER_NAME}/$1 [R,L]Saving from this page triggers a graceful server restart, so give it a few seconds before testing. Test with a fresh browser session or curl -I http://yourdomain.com, looking for a 301 and a Location header on https://. Note that a 301 is cached aggressively by browsers, so if you need to undo it later, clear your cache before concluding it hasn’t worked.
If you’re on WordPress, still update both URLs under Settings → General to https://. The redirect alone won’t stop WordPress generating HTTP resource URLs internally.
Verify renewal is actually working
This is the step most people skip, and the one that causes the 3am outage. CyberPanel installs two cron jobs on setup:
0 2 * * * /usr/local/CyberCP/bin/python /usr/local/CyberCP/plogical/renew.py >/dev/null 2>&17 0 * * * "/root/.acme.sh"/acme.sh --cron --home "/root/.acme.sh" > /dev/nullConfirm both are present with cat /etc/crontab and crontab -l as root. If either is missing, renewals silently stop and you won’t find out until the certificate expires.
Then check what your certificates actually think their expiry dates are:
/root/.acme.sh/acme.sh --listThat gives you every domain acme.sh is managing alongside its renewal date. To confirm what the server is genuinely serving, which can differ from what’s on disk if a restart was missed:
echo | openssl s_client -connect yourdomain.com:443 -servername yourdomain.com 2>/dev/null | openssl x509 -noout -datesOne CyberPanel-specific quirk: recent versions default acme.sh to ZeroSSL rather than Let’s Encrypt, and ZeroSSL now requires an account, which is a common cause of failed issuance and failed renewal on otherwise healthy servers. If you hit that, switch the default CA back:
/root/.acme.sh/acme.sh --set-default-ca --server letsencryptSet yourself a calendar reminder to check the –list output roughly a month after issuance. Seeing one successful automatic renewal is the only real proof the chain works.
Force HTTPS across your site
After installing an SSL certificate, your site may still be accessible using both HTTP and HTTPS. To make sure visitors are directed to the encrypted version, configure your website to redirect HTTP requests to HTTPS.
If you’re using Apache with .htaccess, you can add the following to your site’s .htaccess file, normally located in the public_html directory:
RewriteEngine OnRewriteCond %{HTTPS} offRewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]For Nginx or other server environments, configure an HTTP-to-HTTPS redirect according to your server’s documentation.
If you are running on Nginx rather than Apache, you will need to configure the redirect by adding a specific block to your configuration file. Within your port 80 server block, you will typically add code similar to this:
return 301 https://$host$request_uri;If you are managing a WordPress website, forcing HTTPS is incredibly straightforward. Simply log into your WordPress dashboard, navigate to Settings > General, and update both your "WordPress Address (URL)" and "Site Address (URL)" to include https:// instead of http://. Scroll down and save your changes. If you prefer a completely hands-off approach, you can also install a free plugin like "Really Simple SSL." This will automatically detect your certificate and configure your site to run securely over HTTPS with a single click.
Verify the installation
You can use a tool like SSL Shopper or WhyNoPadlock to confirm your certificate is correctly installed and trusted. I’d check that the padlock appears in the most widely-used browsers and that no mixed-content warnings show up in the console. If warnings appear, update resource links (images, scripts, stylesheets) to use HTTPS or protocol-relative URLs.
With the certificate installed, redirects in place, and verification complete, your site will serve encrypted connections by default. You’ll have helped to protect visitors’ data and met modern security expectations.
After forcing HTTPS, you might notice that the secure padlock still isn't showing up, or your browser displays a warning despite the certificate being active. This is usually caused by "mixed content," which happens when your HTTPS site attempts to load specific resources – like images, fonts, or scripts – over an insecure HTTP connection.
To find the exact culprits, right-click on your webpage, select "Inspect," and open the "Console" tab in your browser’s Developer Tools. The console will list the exact HTTP URLs causing the errors. To fix this, you will need to update those hardcoded links to use HTTPS. You can do this by running a search and replace tool on your database, editing your theme files directly, or switching to relative URLs (for example, changing [http://yoursite.com/image.jpg](http://yoursite.com/image.jpg) to /image.jpg).
Certificate Renewal and Maintenance
Finally, it is crucial to remember that SSL certificates are not a "set it and forget it" feature – they eventually expire. Free certificates from Let's Encrypt expire every 90 days, while most paid certificates are valid for up to one year. If your certificate lapses, browsers will immediately block visitors with a severe security warning. To prevent downtime, ensure that your hosting provider has automatic renewals enabled for AutoSSL, or configure a cron job on your server to automatically request and deploy a new certificate before the current one expires.
