Install & manage a third-party SSL certificate

Most sites should use free, auto-renewing Let’s Encrypt SSL — it’s one click and renews itself. But sometimes you have a certificate you bought (a wildcard, an EV/OV cert, or one issued by your company’s CA), or Let’s Encrypt can’t issue for your domain. OrbixPanel lets you install that certificate directly.

Admin/operator feature — found under Security → SSL Certificates.

When to use this

You purchased a certificate (wildcard *.example.com, EV/OV, multi-year).
Let’s Encrypt can’t validate your domain (internal/corporate, unusual setup).
Your organization requires a specific certificate authority.

Otherwise, prefer Let’s Encrypt (Request SSL on the website) — less to manage.

What you need

Two things, both in PEM format (plain text starting with -----BEGIN …-----):

The certificate — full chain. Your certificate plus the intermediate certificate(s) from your CA, concatenated (your cert first, then the intermediates). Many CAs give you a fullchain.pem or a bundle; if you got separate files, paste your cert followed by the intermediates.
The private key — the key you generated with the certificate request (CSR). It must be unencrypted (no passphrase).

If your files are .crt/.cer/.p7b/.pfx, convert them to PEM first (OpenSSL can do this). A .pfx/.p12 bundle in particular must be split into cert + key PEM.

Install it

Open Security → SSL Certificates.
Make sure the website already exists in the panel for that domain (create it first if not).
Expand Install a third-party certificate and fill in:
- Domain — e.g. example.com (or the exact host the cert is for).
- Certificate (full chain, PEM) — paste the cert + intermediates.
- Private key (PEM) — paste the matching key.
Click Install certificate.

OrbixPanel verifies the key matches the certificate (it won’t install a mismatch), stores the files securely on the server, points the site’s web-server config at them, and reloads — the site is now served over HTTPS with your certificate. You’ll see the issuer and expiry confirmed on success.

Manage installed certificates

Installed third-party certificates are listed under Third-party certificates on the same page, with their issuer, expiry, and a status badge (green / amber when expiring / red when expired).

Replace / renew: just install again for the same domain with the new cert + key — it overwrites the old one.
Remove: click Remove. The certificate files are deleted and the site reverts to HTTP until you install a new certificate (third-party again, or Request SSL for Let’s Encrypt).

No auto-renewal — set a reminder

Unlike Let’s Encrypt, third-party certificates don’t renew themselves. Note the expiry date and replace the certificate before it lapses. The panel shows an amber badge as it nears expiry so you’re not caught out.

Troubleshooting

Problem	Fix
“The private key does NOT match the certificate”	You pasted a key from a different cert/CSR. Use the key generated with this certificate’s request.
“could not read the private key”	The key is encrypted (has a passphrase) or isn’t PEM. Remove the passphrase / convert to PEM.
Browser warns about an incomplete chain	You pasted only your certificate. Include the intermediate cert(s) after it (full chain).
“No website found for …”	Create the website for that domain first, then install the cert.
Cert may not cover this domain (warning)	The certificate’s names don’t include this domain. Use a cert issued for it (or a wildcard that covers it).