Getting an HTTPS certificate: from request to installed

Let’s Encrypt handles certificates automatically for most websites, but plenty of things still need one done by hand: an intranet server, a VPN or mail server, a printer or NAS, a load balancer, or a certificate bought for its validation level. The steps are always the same: make a key and a request, send the request, check what comes back, and install the right files together. The private key never leaves your browser here.

Take care with secrets. This runs only in your browser: what you enter isn't uploaded, stored or put in a link, and the page is built so that it can't send it anywhere else. Your browser's extensions and other software on your device can still see what's on screen, so use a device you trust and real secrets only when you need to. Disconnecting from the internet once the page has loaded gives the most protection. Use is at your own risk: see the terms.

1. Make the key and the request

In the Certificate Maker, put the main host name in Common name (CN) and fill in the organisation and Country, two letters. Then list every name the certificate must cover under Alternative names, one a line, the main one included: www.example.com and example.com are different names, and browsers only look at this list. Choose RSA 2048-bit (works everywhere) unless you know every client takes ECDSA, and Make.

Save the private key (.key) somewhere safe first: if you lose it, the certificate is useless. Send the request (.csr) to the certificate authority. To renew later with the same key, paste it under Use a private key you already have.

2. Check what comes back

The authority sends your certificate and usually one or two intermediate certificates. Paste yours into the Certificate Decoder and check: Alternative names lists every name you asked for, Expires is when you expect, and Issuer is the authority you used.

Public certificates now last at most 200 days, falling to 100 days in March 2027 and 47 days in March 2029, so renewing by hand soon means doing this several times a year. Where the server or device supports it, set up automatic renewal (ACME, the method Let’s Encrypt uses, which many paid authorities also offer); otherwise put a reminder in your calendar a few weeks before Expires. Certificates from your organisation’s own authority follow its rules, not these limits.

3. Make sure the key matches

The commonest install failure, especially after a renewal, is pairing the new certificate with the old key, or the reverse: the server refuses to start or clients can’t connect. With the certificate in the Certificate Decoder, paste the private key under Does a private key match it?: it says whether they belong together. It reads the BEGIN PRIVATE KEY, BEGIN RSA PRIVATE KEY and BEGIN EC PRIVATE KEY forms.

4. Put the chain in order

Servers need your certificate followed by the intermediates, in order, in one file (often called fullchain.pem). Paste them together into the Certificate Decoder, yours first: the message says whether each one is issued by the next and whether its signature checks out. If it says one isn’t issued by the next, the order is wrong or an intermediate is missing; a chain that works in your browser but fails in apps and older phones is usually missing its intermediate. Leave the root out: clients already have it.

5. Check the site once it’s live

Copy the response headers from the browser’s developer tools (Network, then the page’s first request), or run curl -sI https://www.example.com, and paste them into Security Headers & CSP. It checks Strict-Transport-Security, which tells browsers to use HTTPS from now on, and the other headers that protect a site, and builds a Content Security Policy if you need one.