Instalar un TLS certificate en your servidor
Después receiving un signed certificate de un CA, instalar it con el correct chain order y verificar el deployment con un TLS handshake.
- 1
A complete TLS deployment requires: the server certificate, the private key, and the intermediate certificate chain. The chain must be in order: server cert first, then intermediates up to the root. A missing or out-of-order chain causes "untrusted certificate" errors in browsers.
- 2 Herramienta RSA →
Verify your private key matches the certificate by comparing the public key modulus. If they do not match, the certificate was generated with a different key and will not work.
- 3 Calculadora de hash →
Calcular the SHA-256 fingerprint of the certificate to verify it matches what the CA issued. This detects corruption or tampering during download.
- 4
After installation, test with a TLS client (e.g., openssl s_client, curl, browser). Verify: the chain is complete, the certificate is not expired, the hostname matches a SAN, and OCSP stapling works. Monitor expiration and set renewal reminders.
Preguntas frecuentes
- Why do browsers show "untrusted" even with a valid certificate?
- The most common cause is a missing intermediate certificate. The server must send the full chain (server + intermediates). The root is not sent — it must already be in the browser's trust store.
- How do I automate renewal?
- Use ACME (Let's Encrypt) with a client like certbot or acme.sh. Set up a cron job to renew 30 days before expiration. For paid certificates, use the CA's API or set calendar reminders.