Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
To install a certificate bought from a commercial certificate authority (CA), keep the private key that was generated with its CSR, download the issued server certificate and the CA’s intermediate bundle, place each item in the correct platform field or file, configure HTTPS, and test the live endpoint. The certificate must match the private key, and the intermediate certificates must be sent in the order required by your server. The exact screens differ between cPanel/WHM, Nginx, and IIS, but the evidence you need is the same: correct hostnames, a matching key pair, a valid issuer chain, restricted private-key access, and a successful post-installation test.
What you need before you start
A commercial certificate installation is not just a matter of uploading one file. The CA issues a public certificate from a certificate signing request (CSR), while your server retains the private key created when that CSR was generated. The two must remain together throughout the deployment.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The issued files
- Server certificate: The public certificate issued for your domain or domains. It is often supplied as a
.crt,.cer, or.pemfile. - Intermediate bundle: One or more CA certificates that connect your server certificate to a trusted root. A CA may call this a CA bundle, chain file, or CABUNDLE.
- Private key: The secret key generated with the CSR. It may be stored as a
.keyfile or inside the server’s certificate store. Never email it, publish it, or paste it into a support ticket unless you are using a controlled, approved secret-management process. - CSR record: Keep a record of the CSR and the hostname information used to request the certificate. The CSR itself is not secret, but it identifies the key pair for which the CA issued the certificate.
Access and timing requirements
- Have administrative access to the actual HTTPS terminator. This may be cPanel/WHM, an Nginx host, IIS, or a load balancer in front of the application.
- Know every hostname the endpoint must serve. A certificate for
example.comdoes not automatically coverwww.example.com, and a certificate for one site does not cover unrelated virtual hosts. - Schedule a reload or restart if the platform requires one, and make sure you can roll back the previous certificate and configuration.
- Keep the CA’s expiry date and renewal process in your operations calendar. Installing a certificate manually does not, by itself, create automatic renewal.
The installation workflow
- Create or locate the CSR and matching private key. cPanel describes the CSR as the formal request your server sends to the CA to start the process. If another system generated the CSR, the corresponding private key must be imported or remain available on the system that will terminate HTTPS.
- Complete the CA’s validation. Follow the CA’s domain or organization validation process. After issuance, download both the server certificate and every intermediate certificate the CA supplies.
- Check names and the key pair. Confirm that the certificate’s subject or subject-alternative names cover the hostnames you will serve. Confirm that the public certificate pairs with the retained private key before changing production configuration.
- Install the files using your platform’s method. cPanel/WHM uses certificate, key, and optional bundle fields; Nginx uses certificate and key directives; IIS uses certificate stores and an HTTPS binding.
- Build and serve the chain. Where a combined file is required, put the server certificate first and the intermediate certificates after it. Do not put a root certificate first in the file.
- Reload or restart the service. Use the platform’s normal configuration-validation and reload procedure. A failed reload should leave the previous working configuration in place when the platform supports that behavior.
- Test the public endpoint. Check the hostname, expiration, issuer, key match, and complete chain from outside the server. A local file inspection is not enough; clients must receive the intended certificate and intermediates.
How the certificate, key, and bundle fit together
The server certificate is public. The private key is the secure entity that proves the server controls the certificate’s identity during TLS negotiation. The intermediate bundle is public as well, but it is operationally essential because clients use it to build a path from the server certificate to a trusted root.
Do not generate a new key accidentally
If you create a new private key after the CA has issued the certificate, the old certificate will not match it. Either use the original key generated with the CSR or request a reissue for a CSR created from the new key. Do not overwrite the only copy of the original key until the new deployment has been verified.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Keep the private key restricted
Store the key with permissions that allow the HTTPS service’s master process to read it but prevent ordinary users from reading it. The certificate and chain can be broadly readable when the platform requires that, but the private key should not be copied into web directories, source repositories, tickets, or shared documents.
Plan for multiple names
A wildcard or multi-domain certificate can cover several names when those names are included in the certificate. cPanel documents SNI support for hosting multiple certificates and for wildcard or multi-domain certificates. Even with SNI, each virtual host must be mapped to the intended certificate and private key; otherwise a client may receive the certificate for a different site.
Free tools Windows power users keep installed
One-click scans. No signup required.
Installing through cPanel and WHM
cPanel’s SSL/TLS tools manage private keys, CSRs, certificates, and HTTPS installation. The wording and layout can vary slightly by cPanel release and by whether you are working as a reseller, account user, or WHM administrator.
1. Confirm the key and certificate are available
Open the SSL/TLS area and verify that the private key associated with the CSR is present. If the key was generated on another server, import it through the key-management function or use the WHM installation page’s manual key field. Do not paste a key belonging to a different CSR.
2. Open the certificate installation page
In WHM, use the SSL/TLS installation page for a domain. The current interface supports several methods:
- Browse Certificates: Select a certificate already stored in WHM.
- Autofill by Domain: Enter the domain and let WHM find the certificate and matching key it already knows.
- Manual entry: Paste the certificate into the Certificate (CRT) field, the matching private key into Private Key (KEY), and the CA-provided intermediate chain into Certificate Authority Bundle (CABUNDLE) when the interface requests it.
3. Install and inspect the result
Click Install only after checking that the domain shown by the interface is the one you intend to change. If the CA bundle is optional in the form, supplying it is still the safer choice for clients that do not already have the intermediate cached. After installation, inspect the resulting domain or virtual-host entry and confirm the certificate dates and covered names.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
4. Understand cPanel automation separately
cPanel’s Manage AutoSSL feature can obtain and renew certificates through an automated provider workflow. That is different from manually installing an already issued commercial CA certificate. Buying or renewing through an SSL/TLS wizard or a certificate store does not mean that a manually pasted certificate will renew itself. cPanel’s store documentation identifies Sectigo as the issuer for certificates purchased through that store; certificates obtained elsewhere follow the issuing CA’s delivery and renewal process.
5. Account for SNI and virtual hosts
When several HTTPS sites share one address, verify the hostname-to-certificate mapping. A browser can show a valid certificate while still receiving the wrong site’s certificate if the request reaches an unintended virtual host. Test each name separately, including aliases and wildcard-covered names.
Installing on Nginx
Nginx requires a public server certificate and a private key that the Nginx master process can read. The certificate chain must be assembled correctly before you point the configuration at it.
1. Prepare a chained certificate file
When the CA supplies a server certificate and an intermediate bundle separately, create a combined file with the complete server certificate first, followed by the intermediate certificates in the order supplied by the CA. The first certificate in the file is the identity Nginx presents for the site. Reversing the order can make Nginx try to use the bundle’s first certificate with the private key, producing a key-values-mismatch error or preventing startup.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute-----BEGIN CERTIFICATE-----
(server certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(first intermediate certificate)
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
(next intermediate certificate, if supplied)
-----END CERTIFICATE-----Keep the combined certificate file separate from the private key. Do not concatenate the private key into the public chain file.
2. Configure the HTTPS server block
Point the HTTPS listener at the chained certificate and the matching key. A typical configuration is:
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
server {
listen 443 ssl;
server_name www.example.com;
ssl_certificate /etc/nginx/ssl/www.example.com.chained.crt;
ssl_certificate_key /etc/nginx/ssl/www.example.com.key;
ssl_protocols TLSv1.2 TLSv1.3;
}Use paths appropriate to your host and keep the key outside publicly served document roots. If you have several server blocks, verify that each server_name and certificate path are paired intentionally.
3. Set permissions and validate before reloading
The certificate can be public, but the key must be restricted while remaining readable by the Nginx master process. Run the configuration-validation check provided by your Nginx deployment before reloading. If validation reports a key mismatch, check both the first certificate in the chained file and the key selected by ssl_certificate_key.
4. Reload and verify every name
Reload Nginx using your operating system’s service procedure after validation succeeds. Then connect to the live endpoint from an external client. A successful reload only proves that Nginx accepted the syntax; it does not prove that the right virtual host, hostname coverage, expiry date, or intermediate chain is being served.
Installing on IIS
IIS uses Windows certificate stores and site bindings rather than Nginx-style certificate-file directives. Microsoft explains that an intermediate certificate helps establish whether a server certificate was ultimately issued by a valid root CA, and IIS uses that chain when deciding what to send to clients.
1. Import the server certificate with its private key
Use the certificate-management workflow appropriate to your Windows and IIS release. The server certificate must be imported into a store where IIS can access its private key, normally the computer account’s personal certificate store. If the CA delivered a package containing the private key, protect that package and its import password as secrets.
2. Import the intermediate certificates
Place each CA-supplied intermediate in the computer account’s Intermediate Certification Authorities store, or in the store location required by your Windows version and deployment policy. Installing only the leaf certificate can leave IIS unable to build the chain that clients need.
Recommended Free Tools
Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
3. Bind the certificate to the site
In IIS Manager, edit the site’s HTTPS binding and select the intended certificate. Specify the correct IP address, port, and hostname for the site. If multiple HTTPS sites share an address, use hostnames and SNI as supported by your IIS version. The exact import and binding screens vary by Windows/IIS release, so follow the labels shown by the release you operate rather than assuming that an older walkthrough matches your server.
4. Check the private-key association
In the certificate properties, confirm that the selected certificate has an accessible private key and that the IIS service account can use it. A certificate that appears in a store but lacks its private key cannot complete the server-authentication handshake.
5. Test the binding externally
Restart or recycle the affected IIS service only as required by your change procedure, then test the public hostname. Inspect the certificate delivered over the network, not merely the certificate visible in the local store. Confirm that IIS sends the intermediates needed by clients to reach a trusted root.
Why the browser reports an incomplete chain
An incomplete-chain warning generally means the server sent its leaf certificate without one or more CA intermediates. Some clients may have cached an intermediate or be able to retrieve it, while others will fail validation. A reliable deployment sends the CA-provided intermediate bundle from the server.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Fixing the chain on each platform
- cPanel/WHM: Paste or select the CA bundle in the CABUNDLE field during installation. If Autofill by Domain does not find it, use manual entry and verify that the bundle belongs to the same issued certificate.
- Nginx: Build the chained certificate file with the server certificate first and the intermediates afterward, then point
ssl_certificateat that file. - IIS: Import the intermediates into the appropriate Windows certificate store so IIS can construct and send the chain.
Do not solve an incomplete chain by replacing the server certificate with a root certificate. The server should present its own certificate and the necessary intermediates; clients already maintain their own trusted-root stores.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Testing the live installation
Perform these checks from outside the server, preferably from more than one network or client type:
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
- Hostname coverage: The requested name appears in the certificate’s subject-alternative names, including every alias you intend to serve.
- Dates: The certificate is currently valid and its expiration date is recorded for renewal planning.
- Issuer: The issuer is the commercial CA that issued the certificate, not an old certificate left on a different virtual host.
- Key pairing: The live certificate corresponds to the private key used by the HTTPS service.
- Chain completeness: The server sends the required intermediates in the proper order and the client can build a path to a trusted root.
- Virtual-host selection: Each hostname receives its intended certificate when requested with SNI.
- Service health: The browser completes TLS negotiation and the application responds normally after the certificate change.
Use a browser’s certificate viewer and an external TLS diagnostic tool to inspect the live chain. A green browser indicator alone can hide a deployment that works only because that particular client already cached an intermediate.
Troubleshooting common failures
| Symptom | Likely cause | Correction |
|---|---|---|
| Browser reports an incomplete chain | The CA intermediate bundle was not installed or not served. | Install the CA-provided intermediates. On Nginx, place the server certificate first in the chained file; on cPanel, fill CABUNDLE; on IIS, import the intermediates into the appropriate store. |
| Nginx will not start or reports a key mismatch | The first certificate in the combined file does not match the configured private key, or the bundle was placed before the server certificate. | Rebuild the file with the server certificate first and verify that ssl_certificate_key points to the key generated for the CSR. |
| cPanel installation fails | The certificate, key, and bundle were pasted into the wrong fields, or Autofill could not locate a matching key. | Use manual entry in the Certificate (CRT), Private Key (KEY), and Certificate Authority Bundle (CABUNDLE) fields, then retry with the correct domain. |
| The wrong site receives the certificate | Incorrect virtual-host, binding, or SNI selection; the certificate may not cover the requested hostname. | Check the hostname-to-certificate mapping and test each name independently. Confirm that the certificate includes the requested name. |
| The certificate appears locally but clients reject it | The private key is missing from the store, inaccessible to the service, expired, or the chain sent to clients is incomplete. | Inspect the live endpoint, verify the key association and permissions, and install the complete intermediate chain. |
| Renewal date arrives and the old certificate is still served | A manual installation was mistaken for automatic renewal. | Obtain and install the renewed certificate, or configure and monitor an approved automated provider workflow such as cPanel Manage AutoSSL where appropriate. |
Choosing an installation approach
| Approach | Best fit | Chain handling | Renewal and key operations |
|---|---|---|---|
| cPanel/WHM fields | Hosting accounts and administrators who manage domains through cPanel. | Paste or select the certificate, private key, and optional CA bundle; WHM can browse or autofill stored certificates. | Convenient manual installation. Manage AutoSSL is a separate automated provider workflow; a manually installed commercial certificate does not renew automatically. |
| Nginx files and directives | Servers where Nginx terminates TLS directly. | Create a chained certificate file with the server certificate before intermediates and reference it with ssl_certificate. |
Requires controlled file permissions, configuration validation, reloads, and a documented process for replacing the certificate and key. |
| IIS certificate stores and bindings | Windows web servers using IIS. | Import the server certificate and intermediates into the appropriate computer stores, then select the certificate in the HTTPS binding. | Uses Windows/IIS access controls and release-specific screens. Confirm that the binding and private-key association survive renewal. |
The certificate authority itself does not determine which installation method you use. Your platform determines where the public certificate, private key, and intermediates belong. Wildcard and multi-domain coverage can reduce the number of certificates, but they increase the importance of accurate hostname inventories and SNI or binding configuration.
Operational practices after installation
Keep an installation record
Record the certificate’s covered names, issuer, serial or identifying details shown by your platform, expiry date, CSR location, private-key location, intermediate bundle, and the server or virtual host where it was installed. Store the record where the operations team can retrieve it without exposing the private key.
Monitor expiry and replacement
Set reminders well before expiration and monitor the live endpoint rather than relying only on a file’s timestamp. During renewal, preserve the currently working certificate until the replacement has passed hostname, chain, and key tests. If you use an automated workflow, monitor whether it successfully renewed and deployed the certificate; automation without alerting can still result in an expired endpoint.
Use least privilege
Limit write access to certificate and key directories. Back up the private key only in an encrypted, access-controlled system. If a private key may have been exposed, treat the certificate as compromised: restrict access, request a reissue from the CA with a newly generated key, and replace the affected deployment.
Test every endpoint after a change
For a multi-domain or multi-server deployment, test every hostname, IPv4 or IPv6 endpoint, load-balancer listener, and origin that can terminate TLS. One server can be correct while another still serves an expired certificate or an incomplete chain.
Final installation checklist
- The CSR’s matching private key is present on the TLS-terminating system.
- The issued certificate covers every hostname the service will answer.
- The server certificate and private key pair correctly.
- The CA intermediate bundle is installed or served in the platform’s required order.
- The private key is restricted but readable by the HTTPS service.
- cPanel/WHM fields, Nginx directives, or IIS stores and bindings point to the intended files and domain.
- The service reloads or restarts without configuration errors.
- An external test confirms the live issuer, expiry, hostname coverage, key match, and complete chain.
- A renewal owner and date are recorded, with automation distinguished from manual installation.
Once all nine checks pass, the commercial certificate is not merely installed on disk or in a control panel; it is correctly presented to clients by the production endpoint.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
