How to Install an SSL Certificate in cPanel

This guide installs an SSL certificate that you ordered from LyraHosting, such as PositiveSSL, on a website in cPanel. The quick way is the AutoInstall SSL plugin, with the token from your order email if the email has one. The manual way uses cPanel's SSL/TLS tools with a private key, the certificate and its CA bundle.

Before you start

You may not need a paid certificate at all. Both of our web hosting plans include free SSL certificates, which you manage in cPanel, and a paid domain-validated certificate encrypts the connection the same way as a free one. A paid certificate makes sense when you need Extended Validation (EV), or when a partner or policy asks for a certificate from a commercial certificate authority. Our SSL certificates page compares them.

Once you have ordered, check these points:

• the certificate covers every name your visitors use. A single-domain certificate for example.com also covers www.example.com;
• both example.com and www.example.com point to your hosting. The certificate authority checks that you control each name, for example with a file on your website or a DNS record, and if the www name fails the check, the certificate is issued without it. Wildcard names can't use the file method;
• you have your cPanel login details, which we email to you after your hosting payment;
• for the quick way, you have the AutoInstall SSL token, if the email you receive when your certificate order is activated has one.

Install the certificate with AutoInstall SSL

AutoInstall SSL is a cPanel plugin that handles the request, the domain check and the installation for you. Its icon appears in the Security section of cPanel on servers where the host has installed it.

1. Copy the token from your order email.
2. Log in to cPanel. In the Security section, click AutoInstall SSL.
3. Paste the token into the field and submit it.
4. On the next page, fill in the details for the certificate: the domain, the administrative contact and the technical contact.
5. Submit the form. The plugin generates the private key and the certificate signing request (CSR) on the server, puts the validation value in place for the certificate authority, then downloads and installs the issued certificate. A progress page shows each step as it runs.
6. Wait for the message that the certificate is active on your website.

For an EV certificate, the certificate authority also checks your organization before it issues the certificate.

To reissue, reinstall or download the certificate later, enter the same token in AutoInstall SSL again. It takes you to the overview page for your certificate. If AutoInstall SSL isn't in your cPanel, or it reports an error, use the manual method below or open a support ticket.

Install a certificate manually

For a manual installation you need three parts: the private key, the certificate (CRT) and the CA bundle, which holds the intermediate certificates. Create the key and the CSR in cPanel, so that the private key stays on the server:

1. Open cPanel » Security » SSL/TLS.
2. Under Certificate Signing Requests (CSR), click Generate, view, or delete SSL certificate signing requests. In the Key menu, choose an existing key, or a key type to generate a new one. Fill in the domain and the other details, then click Generate.
3. Copy the CSR, including its BEGIN and END lines, and submit it for your certificate. The certificate authority receives the CSR. Never send the private key to anyone.
4. Prove control of the domain in the way the certificate authority asks: a file on your website, a DNS record (CNAME or TXT), or an email to an address such as admin@example.com.
5. When the certificate is issued, go back to cPanel » Security » SSL/TLS and click Manage SSL sites, under Install and Manage SSL for your site (HTTPS).
6. Select the domain. Paste the certificate into Certificate (CRT), the private key into Private Key (KEY), and the CA bundle into Certificate Authority Bundle (CABUNDLE). If the key and certificate are already saved in cPanel, Autofill by Domain can fill in the boxes for you.
7. Click Install Certificate.

cPanel marks the CA bundle as optional, but include it: the intermediate certificates link your certificate to a root that browsers trust. cPanel also advises keeping a copy of the private key in a safe place, because a lost key can't be recovered.

From version 134, cPanel can show these tools as tabs of one SSL/TLS Certificates page instead: Requests for CSRs, Keys for private keys, and Installation for Manage SSL sites.

Check the certificate

Open https://example.com and https://www.example.com in a browser. Check that the certificate lists every name your visitors use, and note its expiry date. cPanel » Security » SSL/TLS Status also lists your domains with the type and status of each certificate. To send visitors from http:// to HTTPS, turn on Force HTTPS Redirect for the domain in cPanel » Domains » Domains.

Renew before it expires

A certificate issued since March 15, 2026 lasts at most 200 days, and the maximum falls to 100 days on March 15, 2027. Renew it and install the new certificate before the old one expires. A reissue replaces a certificate before it expires, for example when the private key or the names change. cPanel's AutoSSL normally leaves certificates that it didn't issue alone, unless the host has allowed it to replace ones that are invalid or about to expire.