---
title: My SSL Certificates
description: "**My SSL Certificates** is where a certificate you bought from your provider is turned into files you can install. You supply a certificate signing request, prove you control the domain, and download the issued certificate. Open it from the sidebar…"
url: "https://rackhelm.com/documentation/my-ssl-certificates/"
updated: "2026-09-24"
category: "Client Portal: Managing Your Services"
---

# My SSL Certificates

**My SSL Certificates** is where a certificate you bought from your provider is turned into files you can install. You supply a certificate signing request, prove you control the domain, and download the issued certificate. Open it from the sidebar under **My Services → My SSL Certificates**, or go to `/ssl`.

## Before you start

You need a **CSR** (certificate signing request) generated on the server the certificate will be installed on. Generating the CSR also generates a private key.

```bash
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr
```

> **Warning:** Never paste the private key into the portal. Only the CSR is needed, and a pasted key is rejected outright with a message telling you so. The key must stay on your server — without it the certificate is useless, and anyone who has it can impersonate your site.

## The certificate list

![The My SSL Certificates list with common name, expiry and status columns](/wp-content/uploads/rackhelm-docs/portal-services-ssl-index.png)
The action button reads Configure until the certificate has been submitted, then View.

Columns are **Certificate** (the product), **Common Name**, **Purchased**, **Expires**, **Status** and **Action**. Ten per page.

| Status | Meaning |
| --- | --- |
| **Awaiting configuration** | Bought but not yet set up. Select **Configure**. |
| **Submitting** | Your request is being sent to the certificate authority. |
| **Awaiting validation** | You need to prove control of the domain. |
| **Awaiting issuance** | Validation is done; the authority is issuing. |
| **Reissuing** | A reissue with a new CSR is in progress. |
| **Issued** | Ready to download. |
| **Rejected**, **Failed**, **Cancelled**, **Expired** | Terminal. **Failed** can be configured again; the others cannot. |

## The configuration wizard

![The four-step SSL configuration form: CSR, web server, domain validation and contact](/wp-content/uploads/rackhelm-docs/portal-services-ssl-configure.png)
Verify the CSR before choosing a validation method — the approver email list is loaded from it.

### 1. Certificate Signing Request (CSR)

Paste the whole CSR, including the `-----BEGIN CERTIFICATE REQUEST-----` and `-----END CERTIFICATE REQUEST-----` lines. Select **Verify CSR** to check it: the **Common name** and **Key size** are read back, and the approver email addresses available for that domain are loaded into step 3.

### 2. Web server

Choose the **Server software** the certificate will run on: **Apache / other**, **Nginx** or **Microsoft IIS**.

### 3. Domain validation

Pick how you will prove you control the domain:

| Method | What you do |
| --- | --- |
| **Email** | Approve via a link sent to an address at your domain. Choose the **Approver email address** from the list loaded when you verified the CSR. |
| **DNS (CNAME)** | Add a CNAME record shown to you after submitting. |
| **HTTP file** | Upload a file shown to you after submitting. |

Email validation requires an approver address to be chosen; if the list comes back empty use DNS or HTTP instead.

### 4. Certificate contact

Choose an entry from your address book, or **+ Add a new contact…** and fill in first name, last name, email, phone, address line 1, city, state or region, postcode and country (organisation and job title are optional). A new contact is saved to your address book. The details are recorded against the certificate as it was issued.

Select **Submit & start validation**. You are taken to the certificate's status page with the validation instructions.

## Completing validation

While the certificate sits at **Awaiting validation**, the status page shows what to do for the method you chose:

- **Email** — follow the link in the message sent to the approver address. **Resend approver email** sends it again (limited to 10 requests a minute).
- **DNS** — a table giving the record **Type** (CNAME), the **Host / Name** and the **Value / Points to**. Add it wherever the domain's DNS is hosted.
- **HTTP** — the **Path** to create on your website and the exact **File contents** it must return.

You can also switch method from this page: choose a new one and select **Change**. **Refresh** at the top asks the certificate authority for the current state right away (limited to 20 requests a minute); the portal also polls in the background, so refreshing is a convenience rather than a requirement.

## Downloading the certificate

Once the status reads **Issued**, the page shows the common name, the expiry date and three download buttons:

| Download | File | Use it for |
| --- | --- | --- |
| **Full chain (.pem)** | `yourdomain.fullchain.pem` | Nginx and most modern servers — the certificate followed by the intermediate chain. |
| **Certificate only (.crt)** | `yourdomain.crt` | Servers that take the certificate and the chain as separate files, such as Apache. |
| **CA bundle (.ca-bundle)** | `yourdomain.ca-bundle` | The intermediate chain to accompany the certificate above. |

The certificate is also shown as text at the bottom of the page so you can copy it. Pair whichever file you use with the private key you generated alongside the CSR.

> **Tip:** If the certificate is for a website on your provider's hosting, you can install it from the site's [Domains page](/docs/sites-domains-and-dns/) — paste the private key and the full chain into **Upload Certificate** there.

## Reissuing

A reissue replaces the certificate with one built from a new CSR, within the same term — use it if you lose the private key, move to a new server, or need to change the covered names. Submit the new CSR and validate the domain again. The status moves to **Reissuing** until the new certificate is issued.

## Troubleshooting

| Symptom | Cause / fix |
| --- | --- |
| "Do not paste a private key…" | You pasted the `.key` file. Paste the `.csr` file instead — it begins `-----BEGIN CERTIFICATE REQUEST-----`. |
| "That does not look like a valid PEM CSR." | The begin or end line is missing, or the file is in a binary format. Regenerate it with the openssl command above. |
| "Could not parse the CSR. Please check it is a valid PEM certificate request." | The CSR is structurally valid text but the certificate authority could not read it. Regenerate it with a 2048-bit or larger RSA key. |
| "No addresses returned — try DNS or HTTP validation" | The authority found no approved email address for the domain. Use DNS or HTTP validation. |
| "Choose an approver email address for email validation." | Email validation was selected without an address. Verify the CSR first so the list loads. |
| The status stays on **Awaiting validation**. | The check has not passed yet. For DNS, confirm the CNAME resolves; for HTTP, load the file's URL in a browser and check it returns exactly the contents shown; for email, check the spam folder and resend. |
| "This certificate can no longer be configured." | It has already been submitted. Use the status page — or wait for it to fail before configuring again. |
| "This certificate cannot be reissued yet." | The certificate has not been issued once, so there is nothing to reissue. |
| A download link returns nothing. | Only an issued certificate can be downloaded, and the CA bundle only exists if the authority supplied one. Use **Full chain** instead. |
| The browser still warns after installing. | The intermediate chain is missing. Install the full chain file, or the certificate plus the CA bundle, and restart the web server. |