Overview
You can import an SSL certificate that you bought from another company in the DreamHost panel. This article explains how to generate a Certificate Signing Request (CSR) in the panel for your Certificate Authority (CA) and how to import your certificate from the website's Security tab.
If you don't need a certificate from another company, you can add a free Let's Encrypt certificate instead. See Adding a free Let's Encrypt certificate.
Before you begin
Your certificate, which your CA sends after issuing it.
Your private key. If you create your CSR in the panel, the panel fills in the private key for you. If you created your CSR through SSH or somewhere else, use the private key you created with it.
An intermediate certificate, if your CA gives you one. This is optional.
Your private key must not be password-protected. The panel does not accept protected keys.
If you have a signed certificate but not its private key, you can't import it. In that case, generate a new CSR and ask your CA to reissue your certificate.
Some CAs send your certificate files in a zip file. Extract the files before you begin:
On a Mac, double-click the file.
In Windows, right-click the file and select Extract All.
Opening the import form
Navigate to the Manage Websites page.
Click the Manage button to open Website settings, which allows you to modify various configurations for your site.
If in Grid view, click the Manage button at the bottom of the website box.
If in List view, click the Manage button at the far right of your domain name.
Click the Security tab.
Open the import form:
If your site doesn't have a certificate, expand Import a Certificate.
If your site already has a certificate, click Manage, click Change, and then expand Import a Certificate.
Generating a CSR in the panel
Your CA needs a CSR to issue your certificate. If your CA already issued your certificate, skip to the Importing your certificate section.
Open the import form.
In the Need a certificate? box, click Generate.
Complete the form:
Common Name — Enter your domain name, such as
example.com. Do not includehttp://orhttps://. Check with your CA whether your certificate also coverswww.Organization Name — Enter your company name. If you don't have a company name, enter your full name.
Organizational Unit Name — This field is optional.
Click Generate.
Click Download under the Certificate Signing Request and under the RSA Private Key, and keep both files in a safe place. Then click Done.
Give the CSR to your CA. Your CA uses it to issue your certificate.
To create a CSR through SSH instead, see Creating a CSR.
Importing your certificate
Open the import form.
Complete the fields:
Certificate Signing Request — This field is optional. If you generated your CSR in the panel, the panel fills it in for you.
Certificate — Paste the certificate your CA sent you.
RSA Private Key — If you generated your CSR in the panel, the panel fills in the private key for you. Otherwise, paste your private key. Keys that begin with
BEGIN PRIVATE KEYorBEGIN RSA PRIVATE KEYare both accepted.Intermediate Certificate — This field is optional. Paste the intermediate certificate if your CA gave you one.
If your site already has an imported certificate, check the box to confirm that the new certificate replaces it.
Click Proceed with Certificate Configuration. The new certificate is pushed out to the live servers within 15 minutes.
After the certificate is active, load your site in a browser using https.
A lock icon appears at the beginning of the URL. When you click the icon, a popup indicates that the certificate is verified and active.
When the certificate is active, the Security tab shows Secure Certificate – Active with the label Imported and the certificate's expiration date. Your site redirects to HTTPS automatically. You can change this with the Automatic HTTPS setting on the certificate's Manage page.
Renewing an imported certificate
Imported certificates don't renew automatically. Before your certificate expires, get a new certificate from your CA and import it using the steps in the Importing your certificate section. You can check the expiration date on the Security tab.
Troubleshooting
"Key does not match" error
This error means the certificate doesn't match the private key in the form. This usually happens when the certificate was issued with a different CSR. Make sure you use the private key that was created with the CSR you gave your CA. If you don't have it, generate a new CSR and ask your CA to reissue your certificate.
