If you switch web hosting providers, you can continue to use your paid SSL certificate – purchased elsewhere and still valid – on your new server. The certificate is linked to the domain, not the server, so it can be installed on any server provided you have the necessary files.

There is no need to transfer a free certificate

If you had a free Let’s Encrypt (or other automatic) certificate on your old hosting account, you do not need to do anything. As soon as the domain points to our servers, the system will automatically request a new certificate for your hosting accounts (see: Let’s Encrypt free certificates). The following applies to paid certificates.

Migration and SSL

We will migrate your website to your new hosting plan free of charge. If the migration is carried out manually, this does not include the transfer of paid SSL certificates. In this case, the certificate must be transferred separately, and we are happy to assist you with this: please open a ticket with our technical support team and attach the necessary files.

What files are required?

The installation involves three steps:

• the certificate (CRT): text beginning with the line -----BEGIN CERTIFICATE-----;
• The private key (KEY) begins with the line: -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----;
• Intermediate certificate (CA bundle): one or more intermediate certificates issued by the certificate authority, which link the certificate to a root certificate recognised by web browsers.

The certificate and private key are essential. The intermediate certificate can be downloaded from the issuer’s website, but the private key cannot be generated retrospectively under any circumstances.

Where can you get them?

• From your old cPanel hosting account: in the Security > SSL/TLS menu, under the Private Keys and Certificates sections, you can view and copy them.
• From your previous provider: if they installed the certificate, ask them for all three parts.
• From a Windows server or other system: you will often receive the certificate and key in a single PFX (PKCS#12) file. You can split this into files in PEM format using OpenSSL; see: Certificate formats: PEM, CRT, PFX – and how to convert them.

Please only transmit your private key via a secure channel; do not send it in an unencrypted email.

Installation in cPanel

1. Log in to cPanel and open the Security > SSL/TLS menu.
2. Click on ‘Manage SSL sites’.
3. Select the domain, then enter the certificate, the private key and the certificate authority bundle (CA bundle) into the appropriate fields.
4. Click on the ‘Install Certificate’ button.
5. Open the website using the https:// prefix and check the certificate details.

If cPanel indicates that the key does not match the certificate, check that the two files belong together. The output of the following two commands must match:

openssl x509 -noout -pubkey -in tanusitvany.crt | openssl sha256
openssl pkey -pubout -in privat.key | openssl sha256

If you have lost your private key

In this case, the old certificate can no longer be used. Create a new private key and CSR, and request a reissue from the provider where you purchased the certificate. Reissues are typically free of charge during the subscription period.

Please check the expiry date

1. Since 15 March, a certificate is valid for a maximum of 200 days, so it must be reissued at least once during a one-year subscription. If you transfer your certificate, you will need to initiate the next reissue with the original issuer. If your subscription expires, you can also purchase an SSL certificate from us.