The article is a manual to get your own SSL certificate. We will go through CSR request, certificate keys and WEDOS web hosting settings. If you prefer automatic SSL settings and renewing, follow the HTTPS at web hosting manual.
This manual will guide you through:
- Private key and CSR request
- Obtaining a certificate
- How to set your certificate to your web hosting
- Frequently asked questions
Private key and CSR request
First step to obtain your own SSL certificate is the private key and the CSR (Certifikate Signing Request). The CSR may be created for example in online CSR generator. Or use the CSR generator provided by chosen certificate authority. Follow all its instructions.
To obtain a private key and a CSR request in your PC, use the Linux OpenSSL tool. How to do it?
- Create a private key:
- Create a CSR:
- Fill all required information. The certification authority may need to verify all your details. Make sure these information are valid:
- Country Name (2 letter code): country code, 2 symbols
- State or Province Name (full name): full country name
- Locality Name (eg, city): city name
- Organization Name (eg, company):full name
- Common Name (e.g. server FQDN or YOUR name):your domain
- Email Address: your e-mail
Example: CSR information for the wds-test.cz domain
State or Province Name (full name) [Some-State]: Cesko
Locality Name (eg, city) : Hluboka nad Vltavou
Organization Name (eg, company) [Internet Widgits Pty Ltd]: WEDOS INTERNET a.s.
Organizational Unit Name (eg, section) :
Common Name (e.g. server FQDN or YOUR name) : wds-test.cz
Email Address : firstname.lastname@example.org
A challenge password :
An optional company name :
Your system will create a private key and a CSR request, both will be saved to private_key.key and CSR_request.csr files. Save the private key file to a well secured storage, the best option may be external drive only for this file.
Issue a certificate
WEDOS does not issue any certificates (we only have automated system for Let’s Encrypt authority). To secure your website we recommend to choose a trustworthy certificate authority, e.g.:
Request a certificate for your domain name. Your URL must perfectly match the domain in certificate. If you use subdomains, fill them in the certificate request. Note that www is also a subdomain. Usually there should be at least two domain names (www and non-www version). To secure high amount of subdomains ask for a wildcard certificate (*.domain.tld)
You can usually issue a certificate for more domain names (ideal when using our multihosting).
Example: the wds-test.cz domain certificate
The certificate for the wds-test.cz will be working for URL https://wds-test.cz only. Will not work for https://www.wds-test.cz, because the www subdomain is not included in the certificate.
The certificate for the www.wds-test.cz will work only for the https://www.wds-test.cz subdomain, will not work for https://wds-test.cz, nor any other subdomain, its issued only for the www subdomain of the wds-test.cz domain. Note that this situation will bring problems for many of your visitors, since they may access the non-www URL first, before being redirected.
The certificate for the *.wds-test.cz (star „wildcard“ certificate) will work for all the subdomains of https://wds-test.cz. It will not work for the domain itself (https://wds-test.cz), because it’s not a subdomain. Note that this situation will bring problems for many of your visitors, since they may access the non-www URL first, before being redirected.
Therefore, don’t forget to include both your domain and all subdomains (or wildcard).
Setting a certificate in the WEDOS Control Panel
When the certificate is issued:
- Go to the control panel.
- In the top navigation go to Hosting services >> Webhosting.
- Choose your web hosting from the list.
- In the left menu, go to the HTTPS link..
- Choose the HTTPS with your own certificate on the domain (SNI).
- Fill in all required information from the files you received from the certification authority. Use password only if set. Include the <BEGIN CERTIFICATE> and <END CERTIFICATE> tags. Our system will ask for any missing information. Certificate chain may be provided or not.
- Save with the Make changes button.
The certificate, if set successfully, will be valid within 90 minutes.
What is a PEM format?
PEM is a format for storing cryptographic data, mainly for keys, certificates. Example:
—–END CERTIFICATE REQUEST—–
Tags in the beginning and the end are informative, but include it.
Frequently asked questions
Question: How to create a CSR request for domain and subdomains?
Answer: For CSR request use only your domain name. The certificate authority may ask you for subdomain list or maybe will use the common names automatically.