GoAdmio
GoAdmio Documentation

Install Paid SSL

From the GoAdmio knowledge base.

Install Paid SSL Certificate

This page explains the Install Paid SSL Certificate screen in GoAdmio. It lists every domain on the server and provides two actions per domain: Download CSR (generate and download the Certificate Signing Request) and Install SSL (paste and install a purchased certificate).

Location: Admin Panel → Security → Install Paid SSL Certificate


Overview

Paid SSL certificates (from DigiCert, Sectigo, GlobalSign, etc.) require a three-step workflow:

  1. Generate a CSR — a Certificate Signing Request containing the domain and your public key
  2. Purchase a certificate — submit the CSR to a commercial CA
  3. Install the certificate — paste the issued certificate, private key, and CA bundle into GoAdmio
The Install Paid SSL Certificate page handles steps 1 and 3. You handle step 2 at the CA's website.

> Note: For free certificates, use Install Free SSL Certificate instead — Let's Encrypt issues and renews automatically, with no CSR workflow.


What the Page Shows

| Column | Description |
|---|---|
| Domain | Every domain on the server |
| Download CSR | Generates a CSR + private key for the domain and downloads it |
| Install SSL | Opens the form to paste and install a purchased certificate |
| Search | Filter the list by domain |
| Footer | Showing 16 of 16 records — total domain count |

> Tip: The list shows every domain on the server, whether or not it already has a certificate. Use it as the central place to manage paid certificates.


Workflow: Purchase and Install a Paid Certificate

Step 1 — Download the CSR

  1. Log in to the GoAdmio Admin Panel.
  2. Navigate to Security → Install Paid SSL Certificate.
  3. Locate the domain.
  4. Click Download CSR.
GoAdmio generates:
  • A CSR file (.csr or .txt) — submit this to your CA
  • A private key (.key) — keep this safe; you will paste it during installation
> Warning: The private key is sensitive. If it is lost, the certificate cannot be installed — you must re-issue. Store it in a password manager or a secure location on the server. Never share it.

> Tip: If your GoAdmio version stores the private key server-side, you do not need to keep the downloaded copy — the installation form uses the stored key. Verify by checking whether Install SSL asks for the key.

Step 2 — Purchase the certificate

  1. Go to your chosen CA (DigiCert, Sectigo, GlobalSign, Comodo, ZeroSSL, etc.).
  2. Purchase the certificate type you need:
- DV (Domain Validated) — verifies domain control only; cheapest - OV (Organization Validated) — verifies the organization's identity - EV (Extended Validation) — highest assurance; shows company name in some browsers - Wildcard — covers *.example.com and the base domain
  1. Paste the CSR when the CA asks for it.
  2. Complete the CA's validation (email, DNS, or HTTP challenge for DV; documents for OV/EV).
  3. Download the issued certificate files.
> Tip: Choose the certificate type based on the customer's requirements. DV is fine for most websites; OV/EV are for businesses that need to display verified identity.

Step 3 — Install the certificate

  1. Return to Security → Install Paid SSL Certificate.
  2. Locate the domain.
  3. Click Install SSL.
  4. Paste the certificate files:
- Certificate (CRT) — the issued domain certificate - Private Key (KEY) — the key generated with the CSR - CA Bundle — the intermediate certificates from the CA
  1. Click Install.
GoAdmio validates the certificate, key, and chain, writes them to the web server configuration, and reloads the web server. HTTPS is now served with the paid certificate.

What the CSR Contains

The CSR includes:

| Item | Description |
|---|---|
| Common Name (CN) | The domain (e.g., example.com) |
| Subject Alternative Names (SAN) | Additional hostnames (www.example.com, etc.) |
| Organization (O) | The organization's name (OV/EV only) |
| Organizational Unit (OU) | Department (optional) |
| Country (C) | Two-letter country code |
| State (ST) | State or province |
| Locality (L) | City |
| Public Key | The public key matching the private key |

> Tip: Some CAs require you to specify the SAN at purchase time (e.g., include www). Check the CA's form carefully — omitting www means the certificate will not cover it.


Verifying the CSR

If you want to inspect the CSR before submitting it to the CA:

```bash

Show CSR details


openssl req -in example.com.csr -noout -text

Verify the CSR's signature

openssl req -in example.com.csr -noout -verify

Verify the private key matches the CSR

openssl req -in example.com.csr -noout -pubkey | \ openssl md5 openssl pkey -in example.com.key -pubout | \ openssl md5
↑