What are the steps involved in creating an SSL certificate?

An SSL (or, more precisely, TLS) certificate verifies to the visitor’s browser that they are indeed connecting to your website and enables an encrypted HTTPS connection. The certificate is issued by a Certificate Authority (CA) after it has verified that the applicant has control over the domain. Below, we outline the steps of the process using a paid certificate as an example; for free Let’s Encrypt certificates on our hosting services, the system carries out this process automatically.

1. Selecting the certificate type

First, decide what you need:

Domain validated (DV): issued for a domain (including the www version) within minutes. This is sufficient for most websites.
Multi-domain (SAN): if you wish to secure several different domains with a single certificate.
Wildcard: if you wish to protect all subdomains of a domain.
Organisation-validated (OV): where the certificate also includes the company’s verified name.

You can compare the different types and their prices on the SSL certificates page.

2. Generating a private key and CSR

The certificate comes with a key pair. The private key remains on the server and must never be disclosed. The CSR (Certificate Signing Request) contains the domain name, the public key and, in the case of an OV certificate, the organisation’s details; this is sent to the certificate authority. The article ‘Creating a CSR and private key’ explains how to create these. If the certificate is to be installed on your cPanel hosting account with us, this step is carried out automatically via the client portal.

3. Proof of ownership of the domain

The certificate authority will only issue the certificate once it has verified that the applicant has control over the domain. Ways to do this include:

e-mail: a confirmation email sent to a designated address (for example, admin@pelda.hu);
HTTP file: placing a verification file on the website;
DNS record: adding a lookup record to the domain’s DNS zone.

In the case of an OV certificate, the certificate authority also verifies the company’s details against official registers.

4. Issuance

Following a successful verification, the certificate authority signs and issues the certificate. For DV certificates, this usually takes a few minutes; for OV certificates, it typically takes a few working days due to the verification of company details. You will receive the issued certificate together with the intermediate certificate (CA bundle).

5. Installation

The certificate, private key and intermediate certificate must be installed on the server hosting the website. On cPanel hosting, this is done via the Security > SSL/TLS menu; on your own server, it is done via the web server (Apache, Nginx) settings. When using the Autoinstall option (via cPanel) in the client portal, the certificate is automatically installed on your cPanel hosting account with us.

6. Verification

Open the website using the https:// prefix and view the certificate details (issuer, validity, domain names) in your browser.
Please check both the www and non-www addresses.
In the command line: openssl s_client -connect pelda.hu:443 -servername pelda.hu displays the full certificate chain. If the intermediate certificate is missing, some browsers and devices will display an error.
Set up a redirect from HTTP to HTTPS so that visitors are always directed to the encrypted version.

7. Reissuance and renewal

Since 15 March, the public certificate has been valid for a maximum of 200 days; from 15 March 2027, this will be 100 days, and from 15 March 2029, 47 days. A one-year subscription therefore includes two certificates: the certificate must be reissued before the first one expires (reissue). For paid certificates, this is not automatic with us, not even in Autoinstall mode: we will send you an email reminder before the expiry date, but you must initiate the reissue yourself. The steps are described in the article ‘Setting up and reissuing a paid SSL certificate’.