SSL certificates
Certificate files and server installation
Which files ZRAZU gives after issuance: fullchain, cert, chain. How to build a PFX for IIS and Windows and where to put them. The private key stays with you.
Once the certificate is issued, its files are available in the card. We do not have the private key, so two files go onto the server: the certificate from us and your key, created together with the CSR.
Which files there are
Open the certificate card, the “Installation” or “Certificate files” section (cabinet). All roles of the organization can download the files.
| File | What is in it | Where it goes |
|---|---|---|
| fullchain.pem | Your certificate with the intermediate ones | nginx, Apache 2.4.8+, HAProxy, Caddy |
| cert.pem | Your certificate only | When the chain is set separately |
| chain.pem | Intermediate certificates only (CA Bundle) | When the chain is set separately |
| Zip with instructions | All three files and a short note | When you want everything together |
| PFX | Certificate, chain and your key in one file | IIS and Windows |
All files are in PEM format, that is plain text. If a program asks for the “chain” or “CA Bundle”, that is chain.pem. The issue date is part of the file name, so new versions do not overwrite earlier ones.
PFX for IIS and Windows
The PFX is built right in the browser; the key is not sent anywhere.
- In the block “PFX for IIS and Windows” pick your private key file (
.keyor.pem, up to 64 KB). - Set a PFX password of at least 8 characters and repeat it.
- Click “Build PFX” and save the file.
The modern cipher (AES-256) is read by Windows Server 2019+, IIS 10, Java and OpenSSL. Windows Server 2016 and older, and macOS Keychain, will not read it. For them build the PFX on your own computer:
openssl pkcs12 -export -legacy -inkey kava.key -in cert.pem -certfile chain.pem -out kava.pfxInstalling and renewing
- Put
fullchain.pemand your private key on the server. - Point your web server settings to them and restart it.
- Check the site: https://zrazu.com/tools/ssl/example.com/ shows which certificate the site serves and until when it is valid. The card also shows whether the site serves exactly this certificate.
A subscription certificate is renewed in parts. So you do not copy the new file by hand, set up automatic renewal for your hosting: How automatic certificate renewal works. If certbot or acme.sh is more convenient for you, see ACME for certbot and acme.sh.
If it didn't work
- “The certificate is not issued yet”. The files appear after the domain is confirmed. See Domain validation.
- “Couldn’t get the certificate files”. Reload the page.
- PFX: “This is not a private key in PEM”. You need a file that starts with
-----BEGIN PRIVATE KEY-----(or RSA/EC PRIVATE KEY). - PFX: the key is password-protected. Remove the password on your computer:
openssl pkey -in key.pem -out open.key, then pick the new file. - PFX: “This key belongs to another certificate”. You need the key used for the CSR of this very order.
- The browser does not provide encryption (WebCrypto). Open the cabinet in a recent Chrome, Firefox or Safari.
- The site serves the old certificate. The new file was not picked up: restart the web server or check the automatic renewal task.