How to Install a Free SSL Certificate.

Tutorial Overview.

This tutorial is all about SSL technology. It will explain what SSL is, why it’s important to have SSL, and the different levels of validation. Then I will show you how to install a free SSL certificate using Let’s Encrypt and ZeroSSL.

Quickies.

• What is an SSL Certificate?
• Why is it Important to Have SSL?
• Do I Need an SSL Certificate?
• Levels of SSL Validation.
• What Type of SSL is Right for My Website?
• How to Get a Free SSL With Let’s Encrypt & ZeroSSL.
• Verify Ownership of Your Domain.
• Upload the Verification Files.
• How to Install a Free SSL Certificate via cPanel.

What is an SSL Certificate?

SSL stands for Secure Sockets Layer. SSL is a security technology for creating an encrypted connection between a browser and a web server. This connection makes it so that all data passed between the browser and the server is private. If you have ever looked at the URL of the websites that you visit you will notice that some start with https: and some start with https: That “s” on the end means that the website is secure and is using SSL.

Why is it Important to Have SSL?

The number one reason to have SSL is security. Without SSL, hackers are able to intercept data between the computer and server and do whatever they want with the data. Google is now flagging websites that don’t have SSL and marking them insecure. They are also including this in their ranking algorithm now so if you don’t have SSL it will hurt your SEO. Having an SSL certificate on your website creates trust with your users and shows them you care about their privacy.

Do I Need an SSL Certificate?

In this day and age, there really is no reason to not have SSL on your website and as I will show you below it can be absolutely free. eCommerce websites are required to be PCI (Payment Card Industry) compliant and one of the requirements of PCI compliance is to have SSL on their website. If you have a website in the healthcare industry and collect, store, or transmit patient data in any way you are required under HIPAA regulations to have SSL on your website. If you have people that login to your website you need SSL so their user information is secure. It doesn’t really matter if you are required to have SSL or not if you are serious about your website you need SSL.

Levels of SSL Validation.

The companies that issue SSL certificates are called Certificate Authorities (CA). When the CA issues an SSL certificate to a website, it needs to verify the website’s identity. There are three levels of validation.

Domain Validation. (DV)

Domain validation has the lowest level of validation. In this case, the CA simply verifies that the applicant has control of the domain in question. This is usually done by uploading a file to your server or changing a DNS entry. If you can display ownership of the domain you will be issued a DV SSL certificate. You will usually receive the SSL certificate the same day. These certificates are low priced or free, in this case, which I will show you below.

Marked as insecure by Google.

Organization Validation. (OV)

Organization Validation is one step above Domain Validation. You will still have to demonstrate ownership of the domain but there are few additional steps. If you want an OV SSL certificate, you will need to submit the documentation requested by the CA and they may call you to for further verification. This process can take up to a few days. These are moderately priced but can vary widely depending on the company.

The padlock shows that the site is secure.

Extended Validation. (EV)

Extended Validation is the most strict type of validation. The CA will perform an in-depth check to verify that you are a legal entity, that you operate at the physical location you claim to and other checks that they feel necessary. You may be required to do this on a yearly basis. These are the most expensive and are usually issued in 3 to 5 days but can take longer.

The padlock with the company name next to it shows that this site has an EV SSL certificate.

What Type of SSL is Right for My Website?

If you run a small blog or personal static website a DV SSL is going to be just fine. If you have a mid-size company or a small eCommerce store, go with an OV SSL. If the website is for a large corporation or large eCommerce store then step up and get the EV SSL certificate.

How to Get a Free SSL With Let’s Encrypt & ZeroSSL.

ZeroSSL now requires an account to get a free SSL certificate.

1. Create an account or login to your ZeroSSL account dashboard.
2. Next to Create SSL Certificate, click New Certificate.

3. Enter the domain name and click Next Step.

4. Select the 90-Day Certificate. (If you want the 1-Year Certificate they will charge you)
5. Click Next Step.

6. Under CSR & Contact, select Auto-Generate CSR.
7. Click Next Step.

8. Select the plan you want to use and click Next Step. I am using the Free plan.
9. Wait while it generates your SSL Certificate.

How to Verify Ownership of Your Domain via HTTP File Upload.

I don’t have an email address set up on this domain so I will show you how to verify with HTTP File Upload. If you want to use email just follow their instructions.

1. Click Download Auth File.

2. Upload the verification files to your server in this location: webroot/.well-known/pki-validation/.
3. The next few sections explain how to upload these files. If you don’t need instructions on how to upload the files, you can skip to Complete the Verification Process.

About the cPanel Folder Structure.

The root directory in cPanel contains system folders that, with the exception of public_html, are not accessible on the web. The public_html directory is in the root and it is where your main cPanel domain name is pointed. You can also create subdirectories to host additional websites in the public_html directory.

a. webroot is how I will refer to the directory that your website is in.

b. .well-known is simply the name of a directory or folder in the webroot. If it is not already in the webroot you will need to create one.

c. pki-validation is also the name of a directory and you will probably need to create it. The pki-validation directory will need to be placed inside the .well-known directory.

How to See if You Have a .well-known Directory via cPanel.

1. Login to cPanel.
2. Click on File Manager.

3. Double click on the icon to the left of the public_html directory.

4. If your website is not in this directory, navigate to the directory that contains your website.

Note: The .well-known directory is a hidden directory so just because you don’t see it doesn’t mean it’s not there.

5. If you don’t see the .well-known directory, click on Settings in the upper right corner.

6. Select Show Hidden Files (dotfiles).

7. If the .well-known file magically appears in the file manager, skip to Create an pki-validation Folder.
8. If you still don’t see the .well-known directory, you will need to create one.

Create a .well-known Directory via cPanel.

1. While in the webroot of your website click on +Folder in the upper left corner.

2. Enter .well-known into the New Folder Name field and click Create New Folder.

How to See if You Have a .well-known Directory via FTP.

1. Make an FTP connection to the website. Detailed instructions if needed: How to Make an FTP Connection with FileZilla.
2. Navigate to the directory that contains your website.

Note: The .well-known directory is a hidden directory so just because you don’t see it doesn’t mean it’s not there.

3. If you don’t see a .well-known folder, make sure your hidden files are visible.

4. I’m using FileZilla. The setting for hidden files is under Server in the top bar. Select Force showing hidden files.

5. If the .well-known file magically appears in the file manager, skip to Create a pki-validation Folder.
6. If you still don’t see the .well-known directory, you will need to create one.

Create a .well-known Directory via FTP.

1. Make an FTP connection to the website. Detailed instructions if needed: How to Make an FTP Connection with FileZilla.
2. Navigate to the directory that contains your website.
3. Left click in the webroot and click Create Directory.

4. Enter .well-known into the field and click Ok.

Create a pki-validation Folder Inside the .well-known Folder.

1. If there is already a pki-validation folder in the .well-known directory, skip this section.
2. Enter the .well-known directory.
3. Use the same method you used above to create a new directory and name it pki-validation.

How to Upload the Verification Files.

1. Enter the pki-validation directory.
2. If you are using FileZilla you can just drag and drop these files into the pki-validation directory.
3. If you are using the cPanel File Manager click Upload in the upper right corner and upload the files.

Complete the Verification Process.

1. Once you have uploaded the file, go back to the Verify Domain window on the ZeroSSL website.
2. Click on the link after Make sure your file is available under the following link: to verify that the verification file is in the right place. You should get a new browser window open that displays the verification text string.

3. If your verification passes, click Next Step. If not you may have the verification files in the wrong folder.
4. Click Verify Domain.
5. Click Download Certificate (.zip)
6. Extract the .zip file on your desktop or another location you will remember.

How to Install a Free SSL Certificate via cPanel.

1. Login to your cPanel account.
2. Locate the Security section and click on SSL/TLS.

3. Click on Manage SSL Sites.

4. Under Manage Installed SSL Websites, find the domain name in question and click on Update Certificate.

5. Open the certificate.crt and the private.key files in a text editor like notepad or something similar.
6. Copy the contents of the certificate.crt file and paste it into the Certificate: (CRT) field.
7. Copy the contents of the private.key file and paste it into the Private Key field.
8. You can copy the contents of the ca_bundle.crt file into the Certificate Authority Bundle field but it should populate itself.

9. Click Install Certificate.
10. You now have an SSL installed on your website.

Additional Posts.

WordPress

---

How to Make a WordPress Restaurant Website to Take Food Orders Online.

Read More

Web Development

---

How to Create FTP Account in cPanel.

Read More

WordPress

---

Why it’s Important to Update WordPress.

Read More