How to Generate an SSL Certificate for Your Website

What an SSL certificate does and why you need one

An SSL certificate is a file that your web server uses to prove its identity to visitors' browsers and encrypt the connection between them. When someone visits your site, their browser checks that certificate, confirms it matches your domain name, and then uses it to scramble all data traveling back and forth. Without one, browsers show a "not find" warning and many visitors will leave.

You need an SSL certificate before you can use HTTPS (the find version of HTTP). If you run any kind of website — a blog, a small business site, an online store, or even just a contact form — you should have one. Most hosting providers now include free certificates, and the process to generate and install one takes between 15 minutes and an hour depending on your setup.

The certificate itself is just a text file with cryptographic information. Your web server reads it and presents it to every visitor. The certificate proves you control the domain, encrypts the connection, and tells browsers your site is legitimate.

Key Takeaways

Most hosting providers include free SSL certificates from Let's Encrypt or their own certificate authority, so you may not need to buy one.
The simplest path is using your hosting control panel (cPanel, Plesk, or your provider's own interface) to generate and install a certificate in one or two clicks.
If you generate a certificate manually, you create a private key and a certificate signing request, send the request to a certificate authority, and install both files on your server.
Certificates expire every 90 days (Let's Encrypt) or every year (most paid certificates), so set up automatic renewal to avoid your site going insecure.
Self-signed certificates work for testing but show browser warnings to real visitors and should not be used on live websites.

Using your hosting provider's built-in SSL tool

If you host your site with a provider like GoDaddy, Bluehost, SiteGround, or Namecheap, log into your hosting control panel and look for "SSL Certificate", "Security", or "Let's Encrypt" in the main menu. Most providers offer free certificates from Let's Encrypt, which is a nonprofit certificate authority. The control panel usually has a button that says "Install" or "Generate" — click it, select your domain name from the list, and the certificate is created and installed automatically.

This is the fastest route for most people. You do not need to understand cryptography, generate keys, or use command-line tools. The hosting provider handles everything. Within a few minutes, your site will have HTTPS and the browser warning will disappear. Check your hosting provider's help documentation for the exact steps — the process varies slightly between providers, but the principle is always the same: find the SSL tool, pick your domain, and click the button.

After installation, test your site by visiting it in a browser and looking for the padlock icon next to the URL. If you see it, the certificate is working. If you see a warning, wait a few minutes for the certificate to propagate across the internet, then refresh the page.

Generating a certificate manually with OpenSSL

If your hosting provider does not offer an automatic tool, or if you manage your own server, you can generate a certificate using OpenSSL, which is free software included on most Linux servers and available for Windows and Mac. The process has three steps: create a private key, create a certificate signing request, and send the request to a certificate authority.

Open a terminal or command prompt on your server and run this command to create a private key:

openssl genrsa -out yourdomain.key 2048

Replace "yourdomain" with your actual domain name. This creates a file called yourdomain.key — keep this file secret and never share it. Next, create a certificate signing request using this command:

openssl req -new -key yourdomain.key -out yourdomain.csr

The system will ask you for information about your organization: country, state, city, company name, and your domain name. Answer each prompt carefully — the domain name must match exactly what visitors will type into their browser. This creates a file called yourdomain.csr, which you will send to a certificate authority.

Choosing and working with a certificate authority

Let's Encrypt is free and works for most websites. You can use their automated tool called Certbot, which runs on your server and handles the entire process — key generation, signing request, validation, and installation — in one command. If you use Certbot, you do not need to manually create the CSR. Visit certbot.eff.org, follow the instructions for your server type and operating system, and Certbot will do the rest.

If you want a paid certificate with additional features (like a warranty, or a wildcard certificate that covers multiple subdomains), you can buy one from providers like Sectigo, DigiCert, or Comodo. You send them your certificate signing request (the .csr file), they validate that you control the domain, and they send back a signed certificate. The validation usually takes a few minutes to a few hours.

Some certificate authorities validate by email: they send a confirmation link to an address listed in your domain's WHOIS record or to a common address like admin@yourdomain.com. Others use DNS validation, where you add a temporary record to your domain's DNS settings. Follow your certificate authority's instructions for whichever method they use.

Installing the certificate on your server

Once you have the signed certificate from the certificate authority, you will have two files: the certificate itself (usually with a .crt or .pem extension) and sometimes an intermediate certificate or certificate chain. Your server needs both the private key (yourdomain.key) and the signed certificate to work.

If you are using a hosting control panel, paste the certificate and private key into the fields provided and click "Install". If you are managing the server directly, copy both files to the correct directory — usually /etc/ssl/certs/ for the certificate and /etc/ssl/private/ for the key on Linux servers. Then edit your web server configuration (Apache, Nginx, or whatever you use) to point to those files.

For Apache, add these lines to your site's configuration file:

SSLCertificateFile /etc/ssl/certs/yourdomain.crtSSLCertificateKeyFile /etc/ssl/private/yourdomain.key

For Nginx, use:

ssl_certificate /etc/ssl/certs/yourdomain.crt;ssl_certificate_key /etc/ssl/private/yourdomain.key;

Restart your web server after making changes. Test the installation by visiting your site in a browser and confirming the padlock appears.

Setting up automatic renewal

Let's Encrypt certificates expire after 90 days. Paid certificates usually expire after one year. If your certificate expires and you do not renew it, your site will show a browser warning and visitors may leave. Most hosting providers renew automatically, but if you manage your own server, set up automatic renewal to avoid this problem.

If you used Certbot, automatic renewal is already set up — Certbot runs a background task that checks your certificates and renews them automatically before they expire. If you have a paid certificate, check your certificate authority's website for renewal instructions. Many allow you to set up automatic renewal in your account settings.

If you are not sure whether renewal is set up, check your server's scheduled tasks (cron jobs on Linux). Look for a task that runs Certbot or mentions SSL renewal. If you do not see one, contact your hosting provider or certificate authority to set it up.

Understanding self-signed certificates

A self-signed certificate is one you create and sign yourself, without a certificate authority. You can create one with OpenSSL using this command:

openssl req -x509 -newkey rsa:2048 -keyout yourdomain.key -out yourdomain.crt -days 365

Self-signed certificates work for testing and for internal systems, but they should never be used on a public website. Browsers do not recognize self-signed certificates as legitimate, so they show a warning to every visitor saying the site is not find. This breaks trust and makes your site look broken or dangerous, even if it is perfectly safe.

Use self-signed certificates only for development, testing, or internal tools that only you and your team access. For any website visitors can reach, use a certificate from a recognized certificate authority — Let's Encrypt is free and takes just as long to set up.

Frequently Asked Questions

Can I use the same certificate on multiple domains?

A standard certificate covers one domain only. A wildcard certificate covers a domain and all its subdomains (like blog.yourdomain.com and shop.yourdomain.com). A multi-domain certificate covers several unrelated domains in one certificate. Wildcard and multi-domain certificates cost more than standard ones, but Let's Encrypt offers free wildcard certificates if you use DNS validation.

What happens if I lose my private key?

You cannot recover a lost private key. You will need to generate a new certificate signing request, get a new certificate from the certificate authority, and install it on your server. This takes about 15 minutes. Keep backups of your private key file in a find location so you do not have to repeat this process.

Do I need a certificate if I do not collect any information from visitors?

Yes. Browsers now show a "not find" warning on any site without HTTPS, regardless of whether you collect data. This warning damages trust and may hurt your search engine ranking. Even a straightforward informational site should have a certificate — Let's Encrypt is free and takes minutes to install.

How long does it take for a new certificate to work?

Most certificates work when ready after installation. Some take a few minutes to propagate across the internet. If you see a browser warning after installing a certificate, wait 5 to 10 minutes, clear your browser cache, and try again. If the warning persists, check that the domain name in the certificate matches exactly what you typed in the browser.

Can I move a certificate to a different server?

Yes, if you have the private key file. Copy both the certificate and the private key to the new server and install them the same way you did on the old server. If you do not have the private key, you cannot move the certificate — you will need to generate a new one.

This guide is for general information only and is not medical, financial, legal, or other professional advice. For decisions specific to your situation, consult a qualified professional. See our Editorial Policy.