Skip to content

Installing Your SSL Certificate

Once domain validation (DCV) is complete and the CA issues the certificate, InteSys delivers the files needed for installation. Most "untrusted certificate" problems after installation don't come from the certificate itself — they come from an incorrectly assembled trust chain.

What InteSys delivers

For every certificate issued, you receive three components:

File Content Common extension
Certificate Your domain's certificate, signed by the CA .crt
Trust chain (CA bundle) The intermediate certificates linking your certificate to a root trusted by browsers .ca-bundle
Private key Generated at request time (CSR), never shared with the CA .key

Some panels and load balancers ask for all three combined into a single PEM, in order: domain certificate, followed by the chain's intermediates. InteSys provides this combined file when the target environment requires that format.

Keep the private key safe

The private key should never be shared, sent over insecure channels, or reused on another domain. If it's generated by your own server at CSR time (the recommended method), it never leaves your environment — only the CSR (which contains no key material) is sent to the CA.

Why the order of the trust chain matters

A browser trusts a small set of root certificates, pre-installed in the operating system or the browser itself. Your domain's certificate is almost never signed directly by a root — it's signed by an intermediate certificate, which is in turn signed by the root.

Trusted root (already in the browser)
        │
        ▼
Intermediate certificate (provided in the CA bundle)
        │
        ▼
Your domain's certificate (.crt)

If the server doesn't send the intermediate certificate(s) during the TLS handshake, the browser may be able to build the chain on its own (some cache common intermediates), but command-line tools, mobile apps and most SEO crawlers don't do that extra work — and they report the certificate as untrusted, even though it's legitimate.

This is by far the most common SSL installation mistake: correct certificate, incomplete chain. Order in the combined file matters too — reversing it (intermediate before the domain certificate) breaks validation on several web servers.

Installing on Nginx

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate     /etc/ssl/certs/yourdomain_com.crt;       # .crt + .ca-bundle concatenated, in that order
    ssl_certificate_key /etc/ssl/private/yourdomain_com.key;

    ssl_protocols       TLSv1.2 TLSv1.3;
    ssl_ciphers         HIGH:!aNULL:!MD5;
}

Nginx's ssl_certificate directive expects the domain certificate and the intermediate chain in the same file, concatenated in that order — there's no separate directive for the CA bundle.

Installing on Apache

<VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com

    SSLEngine on
    SSLCertificateFile      /etc/ssl/certs/yourdomain_com.crt
    SSLCertificateKeyFile   /etc/ssl/private/yourdomain_com.key
    SSLCertificateChainFile /etc/ssl/certs/yourdomain_com.ca-bundle

    SSLProtocol             TLSv1.2 TLSv1.3
</VirtualHost>

Unlike Nginx, Apache accepts the CA bundle as a separate file, via SSLCertificateChainFile (in more recent mod_ssl versions, SSLCertificateFile also accepts the concatenated chain — but using SSLCertificateChainFile explicitly avoids ambiguity).

Other environments

Hosting panels (cPanel, Plesk and equivalents) generally ask for the three components in separate fields — certificate, private key and certificate chain — and assemble the server configuration automatically.

Load balancers and CDNs (AWS ELB/ALB, Cloudflare, HAProxy, etc.) vary quite a bit in the format expected — some want the combined PEM, others the separate components, others manage the chain internally. Talk to our support team if your target environment isn't listed here; we'll identify the right format for your case.

How to verify the installation is correct

After installing, confirm the chain is complete and no trust warnings remain using the SSL Checker — InteSys' free tool validates chain, expiration, protocols and ciphers for any domain, at no cost and with no sign-up.

Need help with the installation? Our specialized support is included — see InteSys SSL Certificates

Next Steps