📌 Purpose & Quick Summary

If your organization utilizes commercial Extended Validation (EV), Organization Validation (OV), or Wildcard SSL certificates purchased from third-party Certificate Authorities (Comodo, DigiCert, Sectigo), the Custom SSL tab allows you to install your Private Key, Certificate (.crt), and Intermediate CA Bundle with full cryptographic verification.

🖥️ Interface Tour & Elements

  1. Domain Selector: Designates the VirtualHost receiving the custom certificate.
  2. Private Key (KEY) Textarea: Area to paste your unencrypted RSA/ECDSA private key (-----BEGIN PRIVATE KEY-----).
  3. Certificate (CRT) Textarea: Area to paste the primary domain certificate (-----BEGIN CERTIFICATE-----).
  4. Intermediate CA Bundle (Optional): Area to paste root and intermediate certificates to establish a complete trust chain.
  5. Install Custom Certificate Button: Validates key-certificate matching and writes files to /etc/ssl/booston/.

🛠️ Step-by-Step Instructions

Step 1: Installing a Commercial Certificate

  1. In SSL/TLS Status, click the Manual / Custom SSL tab.
  2. Select your domain from the dropdown.
  3. Paste your Private Key generated during your CSR creation.
  4. Paste the Certificate CRT provided by your SSL vendor.
  5. Paste the CA Bundle into the third box.
  6. Click Install Custom Certificate.
  7. The system validates that the private key modulus matches the public certificate, installs the files, and applies them to Nginx.

⚙️ Complete Field & Parameter Reference Table

Input Field Format Validation Rule
Private Key PEM Format Must match the public key modulus of the certificate.
Certificate PEM Format Must contain valid domain FQDN in Subject Alternative Names (SAN).
CA Bundle PEM Format Chains server certificate to a globally trusted root certificate authority.

❓ Troubleshooting & Common Errors

1. Error: "Private key does not match certificate"

  • Cause: The private key pasted does not correspond to the CSR used to generate this SSL certificate.
  • Solution: Ensure you paste the exact private key generated when ordering the certificate.