I bought my SSL certificate — what now?
Buying the certificate is the first of four steps. You do the other three, and until they are done your site still has no padlock — the certificate exists, paid for but not issued.
This guide is the whole route. Each step links to the specific instructions for your server.
The four steps
- Generate a CSR on your server. It is a text file with your details and your domain. Generating it also creates a private key, which never leaves that server.
- Enrol the order by pasting that CSR into the generation form in your TiendaSSL dashboard.
- Validate the domain, proving it is yours. Without this the authority issues nothing.
- Install the certificate you receive, on the same server you generated the CSR on.
There is no wait between steps 2 and 3: validation starts the moment you enrol.
1. Generate the CSR
The CSR — Certificate Signing Request — is what tells the certificate authority which domain you want the certificate for and who you are. It is generated on the server you will install the certificate on, not on your own computer.
We have instructions for more than a dozen servers under CSR Generation. If you would rather not touch a command line, you can also use our CSR generator.
The common name (CN) is the field that causes the most errors. It takes the exact domain you want to protect:
| Certificate type | Common name |
|---|---|
| Single domain | yourdomain.com |
| Multi-domain | yourdomain.com (the others go in as SANs, not here) |
| Wildcard | *.yourdomain.com |
Keep the private key. It is generated alongside the CSR and cannot be recovered afterwards. Without it the certificate you receive is useless and you have to start again.
2. Enrol the order
Sign in to your TiendaSSL dashboard, open the order you bought, and paste the whole CSR into the form — including the -----BEGIN CERTIFICATE REQUEST----- and -----END CERTIFICATE REQUEST----- lines.
If the form rejects your CSR, run it through our CSR decoder first: it shows you exactly which domain and which details it carries, which is usually where the mistake is.
This is where most people stop. An order that is bought and never enrolled waits indefinitely: it does not expire, but it does not protect anything either.
3. Validate the domain
The certificate authority has to confirm the domain is yours before it will issue. There are three ways to do it, and you choose which when you enrol.
Each one is covered under Validation. In short: by email to an address at the domain, by a DNS record, or by a file you upload to the server.
4. Install the certificate
Once the authority issues, you receive the certificate by email and can also download it from your dashboard. It comes with the intermediate certificates, which browsers need in order to trust yours.
Instructions per server are under SSL Installation.
When you are done, confirm it all worked with our SSL Checker.
If you get stuck
Get in touch and tell us which step you are on and what your domain is. With that we can see the real state of your order and tell you what is missing.
