English

বাংলা
हिन्दी

English

বাংলা
हिन्दी

Appearance

Install an SSL certificate on a VPS ​

This guide explains how to install a certificate on a web server on your VPS, with the chain in the right place, and how to check the result.

This page is for an origin HTTPS listener, such as direct public hosting. A loopback HTTP origin does not need a separate origin certificate.

Before you begin ​

  • A VPS with access, and a web server already running. See Web server setup.
  • The issued certificate, the intermediate chain, and the private key from your order or CSR.
  • For direct public hosting, DNS points to the VPS and its public HTTPS port is reachable.
  • Root or sudo access, used with care. See SSH keys and root access.

Protect the private key on the server

Set the key file so that only the root user can read it. Do not leave copies in your home folder or in a public folder. Do not share the key by email or chat.

Steps ​

The commands below are for a server running Nginx on a typical Linux system. Paths can differ, so check your web server's documentation first.

  1. Copy the certificate file, the chain file and the private key to a folder that only root can read, such as /etc/ssl/yourdomain/.

  2. Set the key file's permissions:

    bash
    sudo chmod 600 /etc/ssl/yourdomain/yourdomain.key

  3. Combine the certificate and the chain into one file if your web server needs that:

    bash
    sudo sh -c 'cat /etc/ssl/yourdomain/yourdomain.crt /etc/ssl/yourdomain/chain.crt > /etc/ssl/yourdomain/fullchain.crt'

  4. In the server block for your domain, set the certificate and key paths, and enable port 443 with SSL.

  5. Test the web server configuration before you reload it:

    bash
    sudo nginx -t

  6. Reload the web server if the test passes:

    bash
    sudo systemctl reload nginx

  7. Open https://yourdomain.com in a browser and check the padlock.

Expected result ​

The configuration test passes, the site opens over HTTPS, and the browser shows a valid certificate for the domain.

If something goes wrong ​

  • The configuration test fails. Read the error line it shows. It usually names the file or line that is wrong.
  • The browser warns about the chain. Use the combined fullchain file, then reload and test again.
  • Port 443 is blocked. Check the firewall rules you have set. Do not disable the firewall to test. See Updates and firewall.

Last reviewed ​

2026-10-28