SSL certificate

1. Type the domains the certificate should cover, one per line. Add the www. name too if people use it.
2. Pick how to prove the domains are yours: Upload a file (the site must already answer on port 80) or Add a DNS record (needed for wildcards like *.example.com).
3. Press Get the challenge. For files, download the zip and unzip it in your web root (public_html, www, htdocs), or download each file into .well-known/acme-challenge/. For DNS, add each TXT record.
4. Open each link to check that it shows the line of text, then press Verify. Let’s Encrypt fetches the files itself.
5. Download the certificate, the private key and the CA bundle, and paste them into your hosting panel. Save the key before you close the tab.

This is the same ACME conversation certbot has with Let’s Encrypt, written as a small client that runs in this page. Let’s Encrypt’s API accepts requests from browsers, so the page talks to it directly: it creates an account key, orders a certificate, shows you the proof Let’s Encrypt asks for, tells it to check, and signs the certificate request when the check passes. Paid “free SSL” services like PunchSalad do the same steps; the certificate is the same Let’s Encrypt one.

What goes where, exactly. Let’s Encrypt gets your domain names, the public key and the signed request, which it would get from certbot too. The private key is generated with the browser’s Web Crypto API and never sent anywhere; open the Network tab and you will only see requests to acme-v02.api.letsencrypt.org. An unfinished order is kept in this tab’s sessionStorage so a reload while you upload files doesn’t lose it; closing the tab clears it. Check DNS is the one extra request: it asks Google Public DNS (dns.google) for the TXT record.

Limits, honestly. Let’s Encrypt certificates last 90 days (and are getting shorter over the next few years), and nothing here renews them. Put a reminder in the calendar for about day 60 and come back, or, if you can get a shell, let certbot do it: the SSL guide covers both, and if your host has an AutoSSL button, press that instead. Failed checks count against a limit of five per name per hour, so use Staging to rehearse: it runs the whole thing with a fake certificate and generous limits.

The downloads are named the way hosting panels ask for them. In cPanel’s SSL/TLS → Manage SSL sites, certificate.crt goes in CRT, private.key in KEY and ca_bundle.crt in CABUNDLE. Nginx wants ssl_certificate fullchain.pem; and ssl_certificate_key private.key;. Apache 2.4 takes SSLCertificateFile fullchain.pem and SSLCertificateKeyFile private.key.