Install a Free SSL Certificate on cPanel and Shared Hosting

On shared hosting you usually cannot install Certbot or run commands as root, and some hosts charge for SSL even though Let's Encrypt certificates are free. This guide shows how to generate a free certificate online and install it through cPanel's SSL/TLS manager. The same steps work in Plesk, DirectAdmin and most other hosting control panels.

1. Generate the certificate

1. Create a free MTFreeSSL account and verify your email.
2. Click Generate SSL and enter your domain, e.g. example.com.
3. Choose HTTP File Verification — easiest on shared hosting.

2. Upload the verification file with File Manager

1. In cPanel open File Manager and go to your domain's document root (usually public_html).
2. Enable Show Hidden Files in Settings so you can see dot-folders.
3. Create the folder .well-known, and inside it the folder acme-challenge.
4. Download the challenge file from MTFreeSSL and upload it into public_html/.well-known/acme-challenge/. Do not rename it.
5. Open the URL shown on MTFreeSSL in your browser — you should see a line of text, not an error page.
6. Click Verify on MTFreeSSL. When the certificate is issued, download the ZIP.

Prefer DNS? If your domain's DNS is managed in cPanel's Zone Editor, you can choose DNS TXT Record verification instead and add the TXT record there.

3. Install the certificate in cPanel

1. In cPanel open SSL/TLS → Manage SSL sites.
2. Select your domain.
3. Paste the contents of the files from the ZIP:

   cPanel field	File from the ZIP
   Certificate (CRT)	certificate.pem
   Private Key (KEY)	private.key
   Certificate Authority Bundle (CABUNDLE)	ca-bundle.pem

4. Click Install Certificate.

Open each file in a plain text editor and copy everything, including the -----BEGIN ...----- and -----END ...----- lines.

4. Force HTTPS

In cPanel go to Domains and switch on Force HTTPS Redirect for your domain. If your cPanel version doesn't have that option, add this to public_html/.htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} !^/\.well-known/acme-challenge/
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Other control panels

• Plesk: Websites & Domains → SSL/TLS Certificates → Upload certificate files; use private.key, certificate.pem and ca-bundle.pem.
• DirectAdmin: SSL Certificates → Paste a pre-generated certificate and key; paste private.key then certificate.pem, and add ca-bundle.pem under "Click here to paste a CA Root Certificate".

Troubleshooting

• Verification file returns 404 — the folder is in the wrong document root (addon domains have their own), or the folder names are missing the leading dot.
• Verification file redirects to HTTPS and fails — temporarily disable "Force HTTPS" or add the .well-known exception shown above.
• "The certificate does not match the key" — the key is from a different certificate. Use both files from the same ZIP.

Renewing

The certificate is valid for 90 days. Before it expires, generate a new one and paste the new files into the same SSL/TLS screen.