How to Request and Install an SSL Certificate

Introduction

Obtaining an SSL certificate is essential for securing your website and ensuring encrypted communication between the client and server. This guide provides a generic step-by-step process for requesting and installing an SSL certificate. We’ll also include DigiCert as an example of a Certificate Authority (CA).

Step 1: Generate a Certificate Signing Request (CSR)

The first step is to generate a CSR, which is required by the Certificate Authority (CA) to issue your SSL certificate. The CSR contains your domain name and other essential information about your organization.

# Generate a private key and CSR using OpenSSL
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr

# Example of details prompted during CSR creation
Country Name (2 letter code): US
State or Province Name: California
Locality Name: Los Angeles
Organization Name: Your Company
Organizational Unit Name: IT
Common Name (domain name): www.example.com

This generates two files:

• yourdomain.key: Private key (keep this secure).
• yourdomain.csr: Certificate Signing Request to be submitted to the CA.

Step 2: Submit the CSR to a Certificate Authority

Select a trusted Certificate Authority (e.g., DigiCert, Let’s Encrypt, GlobalSign) and submit your CSR. The process typically involves:

1. Logging into the CA’s portal or registering an account.
2. Uploading the .csr file or pasting its content.
3. Choosing the type of SSL certificate (e.g., DV, OV, or EV).
4. Providing additional details, such as administrative and technical contact information.

Choosing the Type of SSL Certificate

One key step is selecting the type of SSL certificate. Certificates are classified into three main validation levels:

• Domain Validation (DV): The CA verifies ownership of the domain name. These are the most commonly used certificates for HTTPS as they are fast to issue, cost-effective, and provide adequate encryption for most websites.
• Organization Validation (OV): The CA verifies both domain ownership and organizational details, offering more trust.
• Extended Validation (EV): The CA performs a rigorous validation process and displays the organization’s name in the browser for maximum trust.

Step 3: Complete Domain Validation

To ensure you own the domain, the CA will require domain validation. This can be done in one of the following ways:

• Email Validation: The CA sends a confirmation email to a pre-approved address (e.g., admin@yourdomain.com).
• DNS Validation: Add a specific DNS TXT record provided by the CA.
• File Validation: Upload a specific file to your web server’s root directory.

Step 4: Certificate Issuance

Once validation is complete, the CA issues your SSL certificate. You will typically receive the following files:

• Certificate File: yourdomain.crt
• Intermediate Bundle: intermediate.crt

Download these files and proceed to installation.

Step 5: Install the SSL Certificate

Install the certificate on your web server. Here’s an example for Apache:

<VirtualHost *:443>
    ServerName www.example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /path/to/yourdomain.crt
    SSLCertificateKeyFile /path/to/yourdomain.key
    SSLCertificateChainFile /path/to/intermediate.crt
</VirtualHost>

Restart your web server:

# Apache
sudo systemctl restart apache2

# NGINX
sudo systemctl reload nginx

Step 6: Test Your SSL Certificate

Verify your SSL certificate installation:

• Use an online tool like SSL Labs.
• Run the following command to test manually:

openssl s_client -connect www.example.com:443

Example: Requesting an SSL Certificate from DigiCert

If you choose DigiCert as your CA, the process will look like this:

1. Log in to your DigiCert account.
2. Upload your CSR file or paste its content.
3. Choose the desired SSL certificate type (e.g., Standard SSL, EV SSL).
4. Complete domain validation via email, DNS, or file upload.
5. Download the issued certificate files and install them on your web server.

Conclusion

Requesting an SSL certificate involves generating a CSR, submitting it to a trusted CA, completing validation, and installing the certificate. While the process may vary slightly depending on the CA, the steps outlined here provide a generic approach. With a secure SSL certificate, your website can offer encrypted communication and build trust with its users.

To know about how the SSL works please visit  how SSL/TLS handshake works