How to install an SSL certificate on your website
In this article, we will cover what an SSL certificate is, why you need one for your website, how to check if your website already has one installed, and the step-by-step procedure for installing a Free or a premium SSL certificate.
What is an SSL certificate?
Secure Sockets Layer (SSL) is a security protocol that creates an encrypted connection between a web server and a web browser.
Transport Layer Security (TLS) is a cryptographic protocol that provides end-to-end data privacy and integrity over the Internet. It is the successor of the SSL protocol.
An SSL certificate is a small data file that digitally binds a cryptographic key to a website owner's details and enables an encrypted connection via SSL/TLS.
An encrypted connection means that data is transferred in a form that eavesdroppers and hackers are unable to read or modify.
A website with an SSL certificate has its URLs starting with HTTPS protocol and has a padlock icon next to the browser address bar.
Why do you need an SSL certificate?
An SSL certificate ensures the secure transfer of information between users' web browsers and your web server.
With it installed on your website, you can rest assured that information shared on your website is safe and no one will read or tamper with it.
These may be contact form details, user registration details, login credentials, sensitive transaction information such as credit card details, or personally identifiable information of the customers.
An SSL certificate improves customers' trust. Nowadays, most web browsers give a warning to users that your website is not secure when you don't have an SSL certificate installed. On the other hand, it shows them that it is secure when you have one installed. With such an assurance, they can comfortably use it and even share information or transact without worrying about the security of their information.
It improves Search Engine Rankings. Search engines (eg. Google, Bing, Duckduckgo, etc) use website security as a ranking factor in their website ranking algorithms of search results. Websites with an SSL certificate are given a higher priority and preference in higher ranking.
An SSL certificate allows you to integrate your website with other websites or applications. Many systems and especially payment platforms only allow integrations with secure websites. Having an SSL certificate installed is one of the requirements for PCI/DSS compliance.
How to check if your website has an SSL certificate installed?
The easiest way to check is to load at the address bar of your web browser after your website loads. If an SSL certificate is installed and the website is configured correctly to load via the SSL connection, the web address/page URL should start with an "https://".
There should also be a padlock icon next to the browser address bar.
However, your website may have an SSL certificate installed but still loading on the not secure "http://" protocol. This happens when configurations to force it to load on a secure connection have not been enforced.
To be sure if the SSL cert has been installed, just change the page URL to start with an "https://" instead of "http://". If the page loads correctly without giving any warning, and next to the address bar there is a padlock, then the cert is installed and all you need is to false the website to load on an SSL connection when people try to access it.
How to install an SSL certificate
Installing a Free SSL certificate
By default, the cPanel account nowadays comes with a free SSL certificate called “Letsencrypt SSL certificate”.
Let’sEncrypt is an open-source certificate authority that provides free SSL/TLS certificates for as many domains as you want.
Most cPanel accounts come with the Let’sEncrypt certificate installed and all you need is to force your website to HTTPS URLs(https://yourdomain) via .htaccess file.
In that case, after you have tested your website by accessing it with "https://" as part of the URL and confirmed you have one installed, the only thing you need to do is to force the redirection to the secure HTTPS connection.
If you don't have one installed, follow the following quick guide.
Step 1: Log in to your cPanel account
Step 2: Click on “Lets Encrypt SSL” under the Security section
Step 3: Scroll down to the "Issue a new certificate" section. You will see a list of all your website domain names and subdomains. Click on the "+ Issue" button of the domain name or subdomain you wish to install the certificate for in the "Actions" column.
Step 4: Your selected domain and all its aliases will be listed down. Ensure they are all checked/ticked. Tick "Add cPanel subdomains as well". Then click the "Issue" button.
On successful installation of the certificate, you will be redirected to a page with the success message below.
The last step is to do the URL redirection to HTTPS connection using the .htaccess file.
In some instances, your cPanel account may not have the "Let's Encrypt SSL" option under the Security menu. In such a scenario, just open the "SSL/TLS Status" option which is under the security section.
You should be able to see all your website domain names and subdomains listed down. If you already have an SSL certificate installed, the icons will be green in color and you will be able to see a message "AutoSSL Domain Validated" alongside each domain under the "Certificate Status" column, with the expiry date.
If the certificate is not installed, the icons will be red in color. Click on the checkbox at the top-left of the table to select all the domain names and subdomains, then click on the "Run AutoSSL" button and the SSL certificate will be installed.
Forcing website to load on HTTPS connection using .htaccess file
When you have an SSL certificate installed, you need to force the website to load on a secure HTTPS connection. You can do that easily by copying this code into your .htaccess file.
If the "RewriteEngine On" line already appears in the .htaccess file anywhere before where you want to place this code, skip it and copy-paste the other line(s).
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301
Or the code below if you want to force your website to load on SSL connection with a "www" on the URLs.
RewriteEngine on
RewriteCond %{HTTP_HOST} ^yourdomain.com [NC]
RewriteRule ^(.*)$ https://www.yourdomain.com /$1 [L,R=301,NC]
Alternatively, add the security header in your .htaccess file will force web browsers to communicate over secure HTTPS. It eliminates the possibility of an HTTP connection.
Header set Strict-Transport-Security "max-age=31536000" env=HTTPS
Installing a premium SSL certificate
If you prefer having a more advanced premium SSL certificate, you can purchase it from your hosting company or from a different SSL certificate seller. If you purchase it from your host, they will do the installation for you.
Else, you will do the installation yourself.
The guide below takes you through a step-by-step procedure of installing an SSL certificate for your website on cPanel.
Step 1: Log in to your cPanel account
Step 2: Click on “SSL/TLS” under the Security section
Step 3: Click “Manage SSL sites”
Step 4: Scroll down to the "Install an SSL Website" section. Copy and paste the certificate into Certificate: (CRT), the Private key, and also CABUNDLE into their places.
Alternatively, you can fill in one eg. the certificate, and click on “Autofill by Certificate” to fill in the others.
Step 5: Click on “Install Certificate” and install the certificate.
Step 6: After the installation is over and successful, the next and last step is to redirect the website to the HTTPS URLs via .htaccess as I had shown you above.
Conclusion
In this article, we have covered what an SSL certificate is, why it is important, how you can check whether your website has one installed, and how you can install one: either a free Let's Encrypt certificate or a premium one.
It's my hope you have enjoyed the article, and that you will be able to implement it and install an SSL cert for your site.
