How to Install an SSL/TLS Certificate & Configure HTTPS (Control Panel, Let's Encrypt ACME & Nginx TLS 1.3)

Installing an X.509 SSL/TLS certificate enables end-to-end HTTPS encryption across your domain, authenticates server identity, prevents active man-in-the-middle (MITM) packet inspection, and unlocks HTTP/2 and HTTP/3 multiplexing in modern browsers. This guide walks through both the 4-step visual activation inside the WinWinHost control panel and the underlying Let's Encrypt ACME (HTTP-01 / DNS-01) and Nginx TLS 1.3 (RFC 8446) server configurations used across our hosting infrastructure.

Part 1: Visual Control Panel SSL Activation Walkthrough

Every domain hosted on WinWinHost Unlimited Web Hosting and Reseller Hosting includes integrated SSL management. Follow these four steps to bind an SSL certificate to your domain virtual host:

Part 2: Comparing SSL/TLS Certificate Validation Tiers & ACME Challenge Types

Whether you are securing a single storefront, a multi-subdomain SaaS application, or a 100-domain agency cluster, selecting the right validation method and ACME challenge protocol ensures uninterrupted certificate renewals.

Part 3: Generating a CSR & Private Key via OpenSSL (ECDSA & RSA-4096)

If you are purchasing a commercial OV/EV certificate or importing a custom certificate into a dedicated KVM Slice, generate your private key and Certificate Signing Request (CSR) locally using OpenSSL. Modern deployments prefer ECDSA P-256 (prime256v1) keys for faster TLS handshakes and smaller signatures, or RSA-4096 for legacy client compatibility:

# Option A: Generate an ECDSA P-256 private key and CSR with Subject Alternative Names (SANs)
openssl req -new -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -nodes \
  -keyout /etc/ssl/private/example.com.key \
  -out /etc/ssl/certs/example.com.csr \
  -subj "/C=US/ST=California/L=Los Angeles/O=WinWinHost Inc./CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Option B: Generate a 4096-bit RSA private key and CSR
openssl req -new -newkey rsa:4096 -nodes -sha256 \
  -keyout /etc/ssl/private/example.com.rsa.key \
  -out /etc/ssl/certs/example.com.rsa.csr \
  -subj "/C=US/ST=California/L=Los Angeles/O=WinWinHost Inc./CN=example.com" \
  -addext "subjectAltName=DNS:example.com,DNS:www.example.com"

# Restrict private key file permissions to root read-only
chmod 600 /etc/ssl/private/example.com*.key

Part 4: Production Nginx TLS 1.2 & TLS 1.3 (RFC 8446) VHost Hardening

On dedicated and multi-tenant Nginx edge gateways (detailed in our Automated SSL/TLS & Edge Cache Management architecture note), always serve the complete fullchain.pem bundle (leaf certificate concatenated with the issuing intermediate CA certificate) rather than cert.pem alone. Omitting the intermediate certificate causes SSL_ERROR_UNKNOWN_CA_ALERT errors on non-caching TLS clients such as curl, OpenSSL CLI, and Android WebViews.

server {
    listen 80;
    server_name example.com www.example.com;

    # Allow unbuffered ACME HTTP-01 renewal challenges over port 80
    location ^~ /.well-known/acme-challenge/ {
        default_type "text/plain";
        root /var/www/letsencrypt;
    }

    # Redirect all other HTTP traffic to canonical apex HTTPS
    location / {
        return 301 https://example.com$request_uri;
    }
}

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Enforce TLS 1.2 and TLS 1.3 (RFC 8446); disable legacy TLS 1.0/1.1
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_prefer_server_ciphers off;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305;

    # Shared TLS session cache across worker processes
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;
    ssl_session_tickets off;

    # Enforce HTTPS via HSTS (2 years)
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
}

Part 5: Verifying Certificate Chains & Automated Renewal Diagnostics

After installing or renewing an SSL certificate, verify the live certificate chain, expiration timestamp, and negotiated TLS protocol version from a terminal:

# 1. Inspect live certificate subject, issuer, SANs, and expiration date
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -subject -issuer -dates -ext subjectAltName

# 2. Test Certbot automated renewal dry-run and systemd timer status
sudo certbot renew --dry-run
systemctl list-timers certbot.timer

# 3. Pre-flight test Nginx configuration syntax before graceful reload
sudo nginx -t && sudo systemctl reload nginx

Frequently Asked Questions (SSL/TLS & HTTPS)