Installation
Server-specific SSL certificate installation guides
24 articles in this category
How to Install an SSL Certificate on Caddy
Caddy is the one server where installing a certificate is partly an act of subtraction. The tls directive loads your files and, in the same line, removes those hostnames from certificate automation — while leaving the HTTP-to-HTTPS redirect and the port 443 listener exactly where they were. Why the intermediate has to be concatenated into the certificate file rather than configured separately, what 'no certificate available for' is telling you, and why a renewal hook that calls caddy reload without --force can succeed and change nothing.
How to Install an SSL Certificate on Traefik
Traefik accepts a purchased certificate through exactly one route, and it is neither of the two places people look first. There is no Docker label that names a certificate file, and traefik.yml — the static configuration — has nowhere to put one; the file provider in dynamic configuration is the only method. Where each file goes, why the intermediate has to be concatenated into certFile, what TRAEFIK DEFAULT CERT is telling you when it appears, and the renewal pattern that survives a 47-day lifetime because it edits configuration rather than overwriting bytes.
How to Install an SSL Certificate on Node.js and Express
Node does not read a certificate bundle the way a web server does. Two option names people hold a letter apart in memory do opposite jobs: cert is the chain you send to clients and must carry the intermediate, while ca is what this process trusts and, if you set it, replaces Node's entire built-in root list rather than adding to it. Why the same setup passes in Chrome and fails on a phone, how setSecureContext swaps a renewed certificate in without dropping a connection, and the port-443 fix that silently disables NODE_EXTRA_CA_CERTS.
How to Install an SSL Certificate on pfSense and OPNsense
A firewall does not keep a certificate as a file. It keeps three separate objects — the issuing CA, the certificate with its private key, and a reference held by each service that presents TLS — and importing the certificate only creates the middle one. Why the chain you serve is built from CA entries rather than from the bundle you were sent, which services keep pointing at the old certificate after the web interface has moved, how to make the ACME package restart the things it renews for, and what 200 then 100 then 47 days does to a box nobody logs into between incidents.
How to Install an SSL Certificate on a FortiGate Firewall
A FortiGate does not have one certificate — it has a slot for every service that speaks TLS, and each is selected in a different menu. Which slot you are actually being asked to fix, why generating the request on the box matters, the second import that everyone skips and only breaks the clients you are not watching, where the certificate goes now that FortiOS 7.6.3 has replaced SSL-VPN tunnel mode, and the one slot no public CA is allowed to sell you a certificate for.
How to Install an SSL Certificate on Proxmox VE
Proxmox keeps three certificate files and only one of them is yours to write — the other two are what the cluster uses to trust itself, and their names differ by seven characters. Which file the web interface actually serves, why a shared filesystem still means running the install command once per node, the Backup Server fingerprint that quietly breaks tonight's job, and what the 200-day limit does to a three-node cluster that renews by hand.
How to Install an SSL Certificate on vCenter Server (vSphere 8)
Every guide to this opens with the certificate-manager menu. The question that decides the outcome comes earlier: a publicly trusted CA cannot issue for vcenter.corp.local, and a great many appliances are named exactly that. Which of the four vSphere certificate stores actually needs replacing, why the wildcard you already own is unusable, what the SubjectAltName and PNID have to agree on, and why a 200-day certificate on an appliance with no ACME client is a decision about maintenance windows rather than about one certificate.
How to Install an SSL Certificate on a Synology NAS (DSM 7)
DSM's built-in Let's Encrypt client speaks only the HTTP-01 challenge to one CA, so it needs port 80 reachable from the internet and the only wildcard it can issue is for a Synology DDNS hostname. That puts a lot of ordinary NAS setups on the import route by definition, not as a fallback. How to generate a CSR in DSM, which of the three files goes in which field, why the optional intermediate field is the one that breaks phone apps, and why a manual import now comes round about twice a year instead of once.
How to Install an SSL Certificate on Google Cloud (Load Balancer and Certificate Manager)
Google Cloud has three separate certificate systems pointing at the same target proxy, and almost every guide covers only the oldest one. A proxy holds 15 Compute Engine SSL certificates or 100 Certificate Manager certificates. And if a certificate map is attached as well, the map is served and the directly attached certificates are ignored with no error at all. Why a self-signed certificate is refused on upload rather than merely distrusted, why a renewal is always a swap and never an edit, and what FAILED_NOT_VISIBLE is really telling you.
How to Install an SSL Certificate on Azure (App Service, Application Gateway and Key Vault)
Azure has two certificate stores and most Azure TLS confusion starts with not knowing which one is in play. A PFX uploaded into App Service lives in a deployment unit tied to one resource group, region and OS, and Application Gateway cannot see it; a certificate in Key Vault is read by both — App Service syncing within 24 hours, the gateway polling every 4. Why the two services need different Key Vault roles, why a versioned secret URI silently stops renewal and disables the listener, and the OpenSSL 3 export flags Azure still expects.
How to Install an SSL Certificate on AWS (ACM, ALB and CloudFront)
Every AWS guide stops at the import wizard. The part that decides how much this costs you comes afterwards: ACM never renews a certificate you imported, and since March 15, 2026 a public TLS certificate may not exceed 200 days — so the job returns roughly twice a year per Region, and about four times from March 2027. How to split the CA bundle into the three files ACM accepts, why CloudFront only reads us-east-1, and why reimporting to the existing ARN keeps every listener and Terraform reference pointing at the same identifier.
How to Install an SSL Certificate on Exchange Server
Importing the certificate is the half of the job nobody notices is unfinished. The two commands that replace the admin center steps Microsoft removed, which names a public CA will refuse to issue, and why the Services column stays empty until you bind it yourself.