BLOG POSTS

MangoHost Blog / How to Install an SSL Certificate from a Commercial Certificate Authority

How to Install an SSL Certificate from a Commercial Certificate Authority

Installing an SSL certificate from a commercial Certificate Authority (CA) is a crucial step in securing your web server and protecting user data through encrypted HTTPS connections. Unlike self-signed certificates that trigger browser warnings, commercial SSL certificates provide trusted encryption that browsers recognize and validate automatically. This guide walks you through the complete process of obtaining, installing, and configuring SSL certificates from commercial CAs, covering common server environments and troubleshooting scenarios you’ll likely encounter in production deployments.

How Commercial SSL Certificates Work

Commercial SSL certificates operate through a chain of trust involving Certificate Authorities that browsers inherently recognize. When you purchase an SSL certificate, the CA validates your domain ownership and sometimes your organization’s identity before issuing a digitally signed certificate.

The certificate contains your public key, domain information, and the CA’s digital signature. When browsers connect to your server, they verify this chain of trust by checking the certificate against the CA’s root certificate stored in their certificate store. This validation process happens automatically and eliminates the security warnings users see with self-signed certificates.

Certificate Type	Validation Level	Typical Use Case	Average Cost
Domain Validated (DV)	Domain ownership only	Personal sites, blogs	$10-50/year
Organization Validated (OV)	Domain + organization verification	Business websites	$50-200/year
Extended Validation (EV)	Full legal entity verification	E-commerce, banking	$200-500/year
Wildcard	DV/OV for all subdomains	Multiple subdomain sites	$100-300/year

Step-by-Step Installation Guide

Step 1: Generate a Certificate Signing Request (CSR)

First, generate a private key and CSR on your server. The CSR contains your public key and domain information that the CA will use to create your certificate.

For Apache/Nginx servers using OpenSSL:

# Generate private key
openssl genrsa -out yourdomain.com.key 2048

# Generate CSR
openssl req -new -key yourdomain.com.key -out yourdomain.com.csr

# You'll be prompted for information:
Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: California
Locality Name (eg, city) []: San Francisco
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Your Company
Organizational Unit Name (eg, section) []: IT Department
Common Name (e.g. server FQDN or YOUR name) []: yourdomain.com
Email Address []: admin@yourdomain.com

For IIS servers, use the IIS Manager or PowerShell:

# PowerShell method
New-SelfSignedCertificate -DnsName "yourdomain.com" -CertStoreLocation "cert:\LocalMachine\My"

Step 2: Purchase and Submit CSR to CA

Popular commercial CAs include DigiCert, Sectigo, GlobalSign, and GoDaddy. After purchasing your certificate:

Submit your CSR through the CA’s web interface
Complete domain validation (usually via email or DNS record)
Wait for certificate issuance (minutes to days depending on validation type)
Download the certificate files

Step 3: Download and Prepare Certificate Files

Most CAs provide certificates in multiple formats. You’ll typically receive:

yourdomain.com.crt – Your domain certificate
intermediate.crt – Intermediate certificate(s)
root.crt – Root CA certificate (optional)

Create a certificate bundle by concatenating certificates in the correct order:

# Create certificate bundle
cat yourdomain.com.crt intermediate.crt > yourdomain.com-bundle.crt

# Verify certificate details
openssl x509 -in yourdomain.com.crt -text -noout

# Test certificate and key match
openssl x509 -noout -modulus -in yourdomain.com.crt | openssl md5
openssl rsa -noout -modulus -in yourdomain.com.key | openssl md5
# The output hashes should match

Step 4: Install Certificate on Your Server

Apache Configuration:

# Copy certificate files to Apache SSL directory
sudo cp yourdomain.com-bundle.crt /etc/ssl/certs/
sudo cp yourdomain.com.key /etc/ssl/private/
sudo chmod 600 /etc/ssl/private/yourdomain.com.key

# Edit Apache SSL configuration
sudo nano /etc/apache2/sites-available/yourdomain-ssl.conf

<VirtualHost *:443>
    ServerName yourdomain.com
    DocumentRoot /var/www/yourdomain
    
    SSLEngine on
    SSLCertificateFile /etc/ssl/certs/yourdomain.com-bundle.crt
    SSLCertificateKeyFile /etc/ssl/private/yourdomain.com.key
    
    # Optional: Force strong ciphers
    SSLCipherSuite ECDHE+AESGCM:ECDHE+AES256:ECDHE+AES128:!aNULL:!MD5:!DSS
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
</VirtualHost>

# Enable SSL site and restart Apache
sudo a2ensite yourdomain-ssl.conf
sudo systemctl restart apache2

Nginx Configuration:

# Copy certificate files
sudo cp yourdomain.com-bundle.crt /etc/nginx/ssl/
sudo cp yourdomain.com.key /etc/nginx/ssl/
sudo chmod 600 /etc/nginx/ssl/yourdomain.com.key

# Edit Nginx configuration
sudo nano /etc/nginx/sites-available/yourdomain

server {
    listen 443 ssl http2;
    server_name yourdomain.com;
    
    ssl_certificate /etc/nginx/ssl/yourdomain.com-bundle.crt;
    ssl_certificate_key /etc/nginx/ssl/yourdomain.com.key;
    
    # Strong SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-RSA-AES256-GCM-SHA512:DHE-RSA-AES256-GCM-SHA512;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;
    
    # HSTS header
    add_header Strict-Transport-Security "max-age=63072000" always;
    
    root /var/www/yourdomain;
    index index.html index.php;
}

# Test configuration and restart
sudo nginx -t
sudo systemctl restart nginx

Real-World Examples and Use Cases

Here are practical scenarios where commercial SSL certificates provide significant value:

E-commerce Platform Setup

An online store processing payments requires EV certificates for maximum trust indicators. Here’s a complete setup for a WooCommerce site:

# Multi-domain certificate installation for main site and CDN
server {
    listen 443 ssl http2;
    server_name shop.example.com www.shop.example.com;
    
    ssl_certificate /etc/nginx/ssl/shop-example-com-multi.crt;
    ssl_certificate_key /etc/nginx/ssl/shop-example-com.key;
    
    # Enhanced security headers for e-commerce
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options DENY always;
    add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' checkout.stripe.com" always;
    
    location / {
        proxy_pass http://backend_servers;
        proxy_set_header X-Forwarded-Proto https;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

API Server with Client Certificate Authentication

For B2B APIs requiring mutual TLS authentication:

# Nginx configuration for client certificate verification
server {
    listen 443 ssl http2;
    server_name api.example.com;
    
    ssl_certificate /etc/nginx/ssl/api-example-com.crt;
    ssl_certificate_key /etc/nginx/ssl/api-example-com.key;
    
    # Client certificate verification
    ssl_client_certificate /etc/nginx/ssl/client-ca-bundle.crt;
    ssl_verify_client on;
    ssl_verify_depth 2;
    
    location /api/v1/ {
        # Pass client certificate info to backend
        proxy_set_header X-SSL-Client-S-DN $ssl_client_s_dn;
        proxy_set_header X-SSL-Client-Verify $ssl_client_verify;
        proxy_pass http://api_backend;
    }
}

Comparisons with Alternatives

Solution	Cost	Setup Complexity	Browser Trust	Automation	Best For
Commercial SSL	$10-500/year	Medium	Full trust	Manual renewal	Business sites, compliance
Let’s Encrypt	Free	Low	Full trust	Automated	Personal projects, testing
Cloudflare SSL	Free-$20/month	Very low	Full trust	Automated	CDN-enabled sites
Self-signed	Free	Low	Browser warnings	Manual	Internal tools, development

Best Practices and Common Pitfalls

Security Best Practices

Use strong key sizes: Minimum 2048-bit RSA or 256-bit ECDSA
Implement proper cipher suites: Disable weak ciphers and protocols
Enable HSTS: Force HTTPS connections
Set up certificate monitoring: Track expiration dates
Secure private keys: Use appropriate file permissions (600)

Common Installation Problems

Certificate Chain Issues:

The most frequent problem is incomplete certificate chains. Browsers may show “certificate not trusted” errors even with valid certificates.

# Test certificate chain completeness
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

# Look for "Verify return code: 0 (ok)" in the output
# If you see error 21 (unable to verify the first certificate), 
# you need to include intermediate certificates

Certificate-Key Mismatch:

Verify your certificate and private key match:

# These commands should produce identical output
openssl x509 -noout -modulus -in certificate.crt | openssl md5
openssl rsa -noout -modulus -in private.key | openssl md5

Permission Problems:

# Correct file permissions for security
sudo chown root:root /etc/ssl/certs/yourdomain.crt
sudo chown root:ssl-cert /etc/ssl/private/yourdomain.key
sudo chmod 644 /etc/ssl/certs/yourdomain.crt
sudo chmod 640 /etc/ssl/private/yourdomain.key

Certificate Renewal Automation

Set up monitoring for certificate expiration:

#!/bin/bash
# certificate-monitor.sh
CERT_FILE="/etc/ssl/certs/yourdomain.crt"
DAYS_BEFORE_EXPIRY=30

EXPIRY_DATE=$(openssl x509 -enddate -noout -in "$CERT_FILE" | cut -d= -f2)
EXPIRY_EPOCH=$(date -d "$EXPIRY_DATE" +%s)
CURRENT_EPOCH=$(date +%s)
DAYS_UNTIL_EXPIRY=$(( ($EXPIRY_EPOCH - $CURRENT_EPOCH) / 86400 ))

if [ $DAYS_UNTIL_EXPIRY -lt $DAYS_BEFORE_EXPIRY ]; then
    echo "Certificate expires in $DAYS_UNTIL_EXPIRY days!"
    # Send notification or trigger renewal process
fi

Performance Considerations

SSL/TLS adds computational overhead, but proper configuration minimizes impact:

Enable SSL session resumption: Reduces handshake overhead
Use HTTP/2: Multiplexes connections efficiently
Implement OCSP stapling: Reduces certificate validation time
Consider hardware acceleration: For high-traffic sites

# Nginx OCSP stapling configuration
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/nginx/ssl/chain.crt;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

Testing your SSL configuration is crucial. Use online tools like SSL Labs’ SSL Test https://www.ssllabs.com/ssltest/ to verify your implementation achieves an A+ rating. The Mozilla SSL Configuration Generator https://ssl-config.mozilla.org/ provides server-specific configurations for optimal security and compatibility.

Commercial SSL certificates remain the gold standard for production websites requiring guaranteed uptime, warranty protection, and maximum browser compatibility. While automated solutions like Let’s Encrypt work well for many use cases, commercial certificates provide additional validation levels, extended support, and the assurance that comes with established Certificate Authorities.

This article incorporates information and material from various online sources. We acknowledge and appreciate the work of all original authors, publishers, and websites. While every effort has been made to appropriately credit the source material, any unintentional oversight or omission does not constitute a copyright infringement. All trademarks, logos, and images mentioned are the property of their respective owners. If you believe that any content used in this article infringes upon your copyright, please contact us immediately for review and prompt action.

This article is intended for informational and educational purposes only and does not infringe on the rights of the copyright owners. If any copyrighted material has been used without proper credit or in violation of copyright laws, it is unintentional and we will rectify it promptly upon notification. Please note that the republishing, redistribution, or reproduction of part or all of the contents in any form is prohibited without express written permission from the author and website owner. For permissions or further inquiries, please contact us.