Install sheets

Which file goes where.

After a reading, you have three files: fullchain.pem (your certificate, then the intermediates), chain.pem (intermediates only, often called the CA bundle) and leaf.crt (your certificate only). Your private key is the one you made with the request; it never comes from us.

Sheet A

Apache HTTP Server 2.4.8 and newer

Since 2.4.8, SSLCertificateFile may hold the certificate followed by its intermediates, so one file does it. (SSLCertificateChainFile is deprecated.)

/etc/apache2/sites-available/example.conf

<VirtualHost *:443>
    ServerName www.example.com
    SSLEngine on
    SSLCertificateFile    /etc/ssl/example/fullchain.pem
    SSLCertificateKeyFile /etc/ssl/example/example.key
</VirtualHost>

Then test and reload: apachectl configtest and systemctl reload apache2 (or httpd). Older than 2.4.8: put leaf.crt in SSLCertificateFile and chain.pem in SSLCertificateChainFile.

Reference: Apache mod_ssl documentation.

Sheet B

Nginx

Nginx has no separate chain setting: ssl_certificate must point at the full chain, certificate first.

/etc/nginx/sites-available/example

server {
    listen 443 ssl;
    server_name www.example.com;
    ssl_certificate     /etc/ssl/example/fullchain.pem;
    ssl_certificate_key /etc/ssl/example/example.key;
}

Then nginx -t and systemctl reload nginx. "key values mismatch" at this step means the certificate was issued for another key: read the CSR and certificate together (rule R12).

Reference: nginx: Configuring HTTPS servers.

Sheet C

cPanel: SSL/TLS, Manage SSL sites

cPanel asks for three boxes. Open each file in a text editor and paste its whole text, BEGIN and END lines included.

Certificate (CRT): leaf.crt
Private Key (KEY): Your key. If you made the request in cPanel, the Autofill button finds it.
Certificate Authority Bundle (CABUNDLE): chain.pem

Many cPanel hosts install free certificates for you automatically (AutoSSL). If yours does, you may not need to install anything by hand.

On shared or managed hosting you may have no server access at all. Then send your host fullchain.pem and ask them to install it; never send them your private key by email.

Glossary

File types, in plain words

.pem: Text with -----BEGIN ...----- lines. Can hold one certificate, several, or a key.
.crt / .cer: A certificate. Usually PEM text, sometimes binary DER; this bench reads both.
.der: A single certificate in binary form. Some Windows tools and devices want this.
.p7b / .p7c: A bundle of certificates (PKCS#7), no key. Common from Windows and some authorities.
.csr: The certificate request you sent to the authority. Holds your public key, never the private one.
.key: Your private key. Keep it on the server. Never paste it into a website, including this one.
.pfx / .p12: Certificate and private key together, password protected (Windows, IIS). Refused here because it contains the key.