An SSL certificate is what turns your site from http:// into https:// — the padlock in the browser. It encrypts the connection between your site and its visitors, protects forms, logins, and payments, and Google takes it for granted: without HTTPS, your site shows up as "not secure". If you purchased a Sectigo (formerly Comodo) certificate from Capa7, here is the full path to installing it in your cPanel account.
Before the steps, keep one idea in mind: the certificate is tied to a private key that is generated and stays inside your cPanel. That key never leaves your server and you never send it to us. You send us only the CSR (a public request), we issue the certificate, and we hand it back to you to paste. That's the whole logic.
Before you start you'll need: access to your cPanel account, the exact domain you bought the certificate for (for example yourdomain.com), and an open ticket with us for the issuance. The certificate you bought is not issued on its own: it needs your CSR to be generated.
1 Generate the CSR from cPanel
The CSR (Certificate Signing Request) is the request that carries your domain's details and is what we need to issue the certificate. When you generate it, cPanel creates at the same time the private key that stays stored on your server. To generate it:
Go to cPanel → "Security" section →
You'll see a panel with several certificate and key options.SSL/TLSClick "Generate, view, or delete SSL certificate signing requests (CSR)"
It's the link labeled Certificate Signing Requests (CSR).Fill in the form
Exact domain (yourdomain.com; for a wildcard use*.yourdomain.com), country, state, city, company, and email. Don't use accents or special characters in these fields.Click "Generate"
cPanel will show a block of text that starts with-----BEGIN CERTIFICATE REQUEST-----and ends with-----END CERTIFICATE REQUEST-----. That whole block is your CSR.
Important: copy the entire block, including the BEGIN and END lines. And once you generate it for a domain, do not generate another CSR for the same domain until the installation is done: each new CSR creates a new private key, and the certificate only works with the key its CSR was generated with.
2 Send us the CSR via ticket
Paste the full CSR into the support ticket you opened for your certificate and submit it. With that CSR we issue the Sectigo certificate for your domain. In the message, also confirm:
The exact domain for the certificate
It must match the one you entered in the CSR letter for letter.The validation email, if applicable
For certificates with email validation, Sectigo sends an approval message to an administrative address on the domain (such asadmin@yourdomain.com). Let us know which to use or follow the instructions in the ticket.
From there the work is ours: we validate, issue, and return the certificate files to you. You don't have to do anything else until we write back.
3 Receive the certificate files
Once the certificate is issued we hand it to you — through the same ticket and/or by email. You'll receive two pieces, essentially:
The certificate (CRT)
This is your certificate itself, a block of text starting with -----BEGIN CERTIFICATE-----. It's the one you'll paste into cPanel.
The CA Bundle (chain)
These are the authority's intermediate certificates (Sectigo). They let every browser trust yours. It's also text; you'll paste it into its own box.
Keep them exactly as they arrive. No need to open or edit them: just copy and paste in the next step.
4 Install the certificate in cPanel
Go back to cPanel → SSL/TLS and this time open "Install and Manage SSL for your site (HTTPS)" (Manage SSL Sites). There:
Pick the domain
In the "Domain" menu, select the same domain you generated the CSR for.Paste the certificate (CRT)
In the first box, Certificate (CRT), paste theBEGIN CERTIFICATEblock we gave you.Check the private key
The Private Key (KEY) box usually fills in on its own, because cPanel already has it (it created it in step 1). If it doesn't autofill, pick it from the dropdown — it's the one for the same domain.Paste the CA Bundle
In the Certificate Authority Bundle (CABUNDLE) box, paste the chain of intermediates we sent you.Click "Install Certificate"
cPanel will confirm with a success message. Done: the certificate is installed on the domain.
The golden rule: CRT + KEY + CA Bundle from the same CSR
The installation works when the three pieces match: the certificate (CRT) we issued, the private key (KEY) your cPanel generated, and the chain (CA Bundle). Since the key has lived in your cPanel since step 1, the only thing to watch is not regenerating the CSR in between. If you do regenerate it, let us know so we can reissue.
5 Verify in "SSL/TLS Status"
To confirm everything went well, in cPanel → SSL/TLS Status look for your domain: it should appear with the green padlock and the Sectigo certificate details (issuer and expiry date). And the final proof, the one that really matters: open https://yourdomain.com in the browser and check that it loads with the padlock and no warnings.
If you see "not secure" after installing: it's usually mixed content — images, scripts, or CSS your site still loads over http://. Make sure internal links use https:// (in WordPress, update the site URL and use a mixed-content plugin if needed). The certificate is fine; what's missing is the site fully using it.
Questions we get a lot
Why don't you just issue the certificate directly without asking me for the CSR?
Because the private key that protects your certificate must be generated and stay on your server, never travel by email. The CSR is the public part that can be shared. That's what makes your certificate truly yours and secure.
My hosting already comes with free SSL. Why this one?
Yes, all our hosting plans include free SSL with AutoSSL (Let's Encrypt). You buy a Sectigo certificate when you need organization validation (OV), extended validation (EV), a wildcard that covers all your subdomains, or the warranty and brand backing of a commercial authority. For a blog or simple site, the free one is enough.
Can I install it myself or do you do it?
You can do it yourself with this guide in a few minutes. But if you prefer, we install it: send us the access through the ticket and we'll leave it working. We can also generate the CSR for you if you ask.
How often is it renewed?
Commercial certificates are issued today for a maximum of one year. As expiry approaches we repeat the process: new CSR, issuance, and installation. We notify you in advance so your site never goes without HTTPS.
What if I generated the CSR but changed my mind about the domain?
No problem: generate a new CSR with the correct domain and send us that one. Just remember to then install with the key from that latest CSR (cPanel associates it with the domain automatically).
Capa7 Team
17 years running hosting, VPS, and dedicated servers on our own infrastructure in Boca Raton, Florida. We write the way we'd like things explained to us: clear and no fluff.
Rather we install it for you?
If any step gets stuck — the CSR, email validation, or mixed content — write to us and we'll sort it out with you. That's what support is for.
Ask on WhatsApp
