# Certificate files and server installation

> Which files ZRAZU gives after issuance: fullchain, cert, chain. How to build a PFX for IIS and Windows and where to put them. The private key stays with you.

URL: https://zrazu.com/en/docs/ssl-files/

Once the certificate is issued, its files are available in the card. We do not have the private key, so two files go onto the server: the certificate from us and your key, created together with the CSR.

## Which files there are

Open the certificate card, the “Installation” or “Certificate files” section ([cabinet](https://vse.zrazu.com/ssl/)). All roles of the organization can download the files.

| File | What is in it | Where it goes |
| --- | --- | --- |
| fullchain.pem | Your certificate with the intermediate ones | nginx, Apache 2.4.8+, HAProxy, Caddy |
| cert.pem | Your certificate only | When the chain is set separately |
| chain.pem | Intermediate certificates only (CA Bundle) | When the chain is set separately |
| Zip with instructions | All three files and a short note | When you want everything together |
| PFX | Certificate, chain and your key in one file | IIS and Windows |

All files are in PEM format, that is plain text. If a program asks for the “chain” or “CA Bundle”, that is `chain.pem`. The issue date is part of the file name, so new versions do not overwrite earlier ones.

## PFX for IIS and Windows

The PFX is built right in the browser; the key is not sent anywhere.

1. In the block “PFX for IIS and Windows” pick your private key file (`.key` or `.pem`, up to 64 KB).
2. Set a PFX password of at least 8 characters and repeat it.
3. Click “Build PFX” and save the file.

The modern cipher (AES-256) is read by Windows Server 2019+, IIS 10, Java and OpenSSL. Windows Server 2016 and older, and macOS Keychain, will not read it. For them build the PFX on your own computer:

```
openssl pkcs12 -export -legacy -inkey kava.key -in cert.pem -certfile chain.pem -out kava.pfx
```

## Installing and renewing

1. Put `fullchain.pem` and your private key on the server.
2. Point your web server settings to them and restart it.
3. Check the site: [https://zrazu.com/tools/ssl/example.com/](https://zrazu.com/tools/ssl/example.com/) shows which certificate the site serves and until when it is valid. The card also shows whether the site serves exactly this certificate.

A subscription certificate is renewed in parts. So you do not copy the new file by hand, set up automatic renewal for your hosting: [How automatic certificate renewal works](https://zrazu.com/en/docs/ssl-auto.md). If certbot or acme.sh is more convenient for you, see [ACME for certbot and acme.sh](https://zrazu.com/en/docs/ssl-acme.md).

## If it didn't work

- **“The certificate is not issued yet”.** The files appear after the domain is confirmed. See [Domain validation](https://zrazu.com/en/docs/ssl-dcv.md).
- **“Couldn’t get the certificate files”.** Reload the page.
- **PFX: “This is not a private key in PEM”.** You need a file that starts with `-----BEGIN PRIVATE KEY-----` (or RSA/EC PRIVATE KEY).
- **PFX: the key is password-protected.** Remove the password on your computer: `openssl pkey -in key.pem -out open.key`, then pick the new file.
- **PFX: “This key belongs to another certificate”.** You need the key used for the CSR of this very order.
- **The browser does not provide encryption (WebCrypto).** Open the cabinet in a recent Chrome, Firefox or Safari.
- **The site serves the old certificate.** The new file was not picked up: restart the web server or check the automatic renewal task.