How to Install an SSL Certificate on Plesk

1 month ago
Remitur
9 minutes

Installing an SSL certificate on Plesk is a straightforward process that can be completed directly from the Plesk control panel.

In this guide, we will show you how to manually install an SSL certificate on a website hosted with Plesk, including the SSL certificate, private key and CA intermediate certificates.

This procedure is useful when you have purchased an SSL certificate from an external Certificate Authority or SSL provider and want to install it on a domain managed through Plesk.

What You Need Before Installing the SSL Certificate

Before starting, make sure you have:

  • Your SSL certificate, usually supplied as a .crt, .cer or .pem file.
  • The private key associated with the certificate.
  • The CA Bundle / Intermediate Certificates, if supplied by the Certificate Authority.
  • Access to the Plesk control panel for the domain.

The private key must be the same key that was used to generate the Certificate Signing Request (CSR).

If you generated the CSR directly from Plesk, the corresponding private key should already be stored in Plesk and normally does not need to be uploaded again.

Important: Keep your private key secure. Anyone who obtains the private key may potentially impersonate your website. Never send or publish your private key unless absolutely necessary.

Step 1 – Log in to Plesk

Log in to your Plesk control panel using the address provided by your hosting provider.

Once logged in, go to:

Websites & Domains

Locate the domain for which you want to install the SSL certificate.

Step 2 – Open SSL/TLS Certificates

Under the domain you want to secure, click:

SSL/TLS Certificates

On current Plesk installations, certificate management is normally handled through the SSL It! interface.

From this section you can view the current certificate protecting the domain, install another certificate and configure additional HTTPS security options.

Step 3 – Upload Your SSL Certificate

If you already have an SSL certificate that you want to use, select the option to Upload the certificate.

Depending on your Plesk version and configuration, you may be able to upload a PEM file containing the certificate information directly.

A PEM-encoded SSL certificate looks similar to:

-----BEGIN CERTIFICATE-----
MIIF...
...
-----END CERTIFICATE-----

Make sure the complete certificate is included, including the BEGIN and END lines.

Installing the Certificate Manually

Depending on your Plesk version and hosting configuration, you may also have access to the certificate repository or advanced SSL/TLS certificate management interface.

In this case, Plesk allows you to manage the individual components of the certificate installation.

These normally include:

  • Private key
  • Certificate
  • CA certificate / CA Bundle

This method can be particularly useful when your Certificate Authority provides the certificate, private key and intermediate certificates as separate files.

Step 4 – Install or Verify the Private Key

Every SSL certificate has a corresponding private key.

A private key usually looks similar to:

-----BEGIN PRIVATE KEY-----
MIIE...
...
-----END PRIVATE KEY-----

or:

-----BEGIN RSA PRIVATE KEY-----
MIIE...
...
-----END RSA PRIVATE KEY-----

If you originally generated the CSR from Plesk, Plesk should already have the corresponding private key.

In this case, you should not generate or replace the private key when installing the issued certificate.

If the CSR was generated on another server or with another application, you will need to provide the original private key together with the certificate.

Why the Private Key Matters

The SSL certificate can only work with the private key associated with the CSR from which the certificate was issued.

If you attempt to install a certificate with an unrelated private key, Plesk will not be able to use the certificate correctly.

If the original private key has been lost, it cannot be recreated from the certificate. You will need to generate a new private key and CSR and have your SSL certificate reissued.

Step 5 – Install the CA Bundle / Intermediate Certificates

Commercial SSL certificates usually require one or more intermediate CA certificates.

These certificates create the chain of trust between your SSL certificate and a trusted root Certificate Authority.

Your SSL provider may refer to these files as:

  • CA Bundle
  • Intermediate Certificates
  • CA Certificates
  • Certificate Chain
  • Chain Certificate

If Plesk provides a dedicated field for the CA certificate, upload or paste the CA Bundle supplied with your SSL certificate.

A certificate chain may contain multiple certificates:

-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----

Keep the certificates in the order supplied by the Certificate Authority.

Installing the correct intermediate certificates is important. An incomplete certificate chain may cause certificate warnings on some browsers, operating systems or applications even if the server certificate itself is valid.

Step 6 – Apply the Certificate to the Domain

After uploading the certificate, return to:

Websites & Domains → your domain → SSL/TLS Certificates

Make sure that the newly installed certificate is being used to secure the domain.

On current versions of Plesk using SSL It!, an uploaded certificate may be automatically installed for the selected domain.

If your Plesk installation presents a certificate selection menu, select the newly installed certificate and save the changes.

Step 7 – Enable HTTPS Redirection

Once the SSL certificate is installed, it is usually a good idea to redirect visitors automatically from HTTP to HTTPS.

In the SSL/TLS configuration for the domain, look for the option:

Redirect from http to https

Enable it if you want all requests made to:

http://example.com

to be redirected automatically to:

https://example.com

This helps ensure that visitors consistently use the encrypted version of your website.

Before enabling a permanent HTTPS redirect, however, make sure that your website works correctly over HTTPS.

Step 8 – Test the SSL Certificate

Open your website using HTTPS:

https://www.example.com

Your browser should load the website without displaying certificate warnings.

However, checking the browser padlock alone is not enough to verify a perfect SSL installation.

You should also check that:

  • the certificate is valid;
  • the certificate has not expired;
  • the correct domain name is included;
  • all required intermediate certificates are installed;
  • the certificate chain is trusted;
  • the correct certificate is being served by the server.

Common Plesk SSL Installation Problems

Certificate and Private Key Do Not Match

This means that the private key stored in Plesk does not correspond to the SSL certificate you are trying to install.

This commonly happens when:

  • a new CSR was generated after the certificate was ordered;
  • the CSR was generated on another server;
  • the wrong private key was uploaded;
  • the original private key was lost.

You must locate the private key associated with the original CSR.

If that key is no longer available, generate a new CSR and request a reissue of the SSL certificate.

The Website Still Shows the Old Certificate

If your browser continues to display the previous certificate, check that:

  • the new certificate has actually been installed;
  • it has been assigned to the correct domain;
  • DNS points to the correct Plesk server;
  • you are checking the correct hostname;
  • a CDN, proxy or load balancer is not terminating the HTTPS connection before it reaches Plesk.

For example, if your website is behind a CDN or reverse proxy, the certificate visible to visitors may be installed on that service rather than directly on your Plesk server.

The Certificate Is Valid but the Browser Reports a Trust Error

An incomplete certificate chain is a common cause.

Make sure the correct CA Bundle / Intermediate Certificates have been installed together with the server certificate.

Always use the intermediate certificates provided for your specific SSL certificate.

The Certificate Works for example.com but not for www.example.com

SSL certificates are valid only for the hostnames included in them.

For example, if your certificate covers only:

example.com

it may not necessarily cover:

www.example.com

Similarly, a standard certificate for example.com does not automatically protect:

shop.example.com

mail.example.com

portal.example.com

If you need to protect multiple subdomains, consider using a Wildcard SSL certificate.

If you need to protect multiple different domain names, a Multi-Domain (SAN) SSL certificate may be more appropriate.

Installing a Renewed SSL Certificate on Plesk

When your SSL certificate is renewed, the new certificate must be installed on the server before the previous certificate expires.

The installation procedure is essentially the same:

  1. Go to Websites & Domains.
  2. Select the domain.
  3. Open SSL/TLS Certificates.
  4. Upload or install the renewed certificate.
  5. Install the appropriate CA certificate chain if required.
  6. Make sure the renewed certificate is active for the domain.
  7. Test the website over HTTPS.

If the renewed certificate was issued using the existing CSR, the existing private key can normally continue to be used.

If a new CSR was generated for the renewal, make sure that the corresponding new private key is used.

Do I Need to Restart Plesk or the Web Server?

Normally, no.

When SSL certificates are installed through the Plesk interface, Plesk handles the required web server configuration.

You normally do not need to manually restart Apache, Nginx, IIS or Plesk.

Plesk SSL Certificate Installation Checklist

After installing your certificate, verify that:

  • the correct SSL certificate is installed;
  • the certificate matches the private key;
  • the CA Bundle / intermediate certificates are installed;
  • the certificate is active for the correct domain;
  • the website loads correctly using HTTPS;
  • all required hostnames are covered by the certificate;
  • the browser displays no certificate warnings;
  • the certificate expiration date is correct;
  • HTTP-to-HTTPS redirection works correctly, if enabled.

Plesk, SNI and Multiple SSL Certificates

Modern Plesk installations support Server Name Indication (SNI).

SNI allows multiple websites hosted on the same IP address to use different SSL certificates.

This means that you normally do not need a dedicated IP address simply to install an individual SSL certificate for each website hosted on your Plesk server.

Conclusion

Installing an SSL certificate on Plesk can normally be completed entirely through the Websites & Domains → SSL/TLS Certificates interface.

The three most important components of a manual SSL installation are:

  • the SSL certificate;
  • its corresponding private key;
  • the appropriate CA certificate chain.

Once the certificate has been installed, always verify the website over HTTPS and check that the server is providing the complete certificate chain.

If you purchased your SSL certificate from EuroSSL, you can retrieve the issued certificate and the required CA certificates from your customer area and install them on your Plesk-hosted website following the procedure described above.

Leave a Reply 0

Your email address will not be published. Required fields are marked *