> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/administration-tasks/installing-or-updating-ssl-certificate.md).

# Installing or Updating SSL Certificate

A new ExaVault installation includes a self-signed certificate. Most client programs do not trust self-signed certificates, and you will likely encounter warnings or errors, depending on the program.

We recommend replacing the default certificate with your own SSL certificate.

## Automatic SSL Certificate Management

A [Premium](/premium-features.md) plan unlocks [automatic SSL certificate management](/premium-features.md#automatic-ssl-certificate-management).

## Installing Your Own Certificate

You manage and update your site's SSL Certificate with the ExaVault Appliance Manager.

The SSL Certificate you provide must be in PEM format as a single file without a password. That file needs to contain all of the following components, in order:

* Certificate
* Intermediate/Certificate Authority Certificate(s)
* Private Key

### Creating A Combined PEM File on Mac/Linux

In Terminal, generate a single PEM file containing all three components of the SSL certificate with the following command:

`cat [certificate file] [bundle file] [private key/PEM file] > [combined_certificate.pem]`

### Creating a Combined PEM File on Windows

On Windows, create a new file in Notepad and save it with a .pem extension.

Copy the contents of each file into the Notepad file in the following order:

* Certificate
* Intermediate/Certificate Authority Certificate(s)
* Private Key

### Installation

Install the SSL Certificate from the ExaVault Appliance Manager at https\:// \[APPLIANCE\_IP-OR-HOSTNAME]:9002.

After logging in, open *HTTP SSL*. Under *Domain Cert*, select *Choose File* to upload the PEM file, then select *Add Domain Cert*.

Modifying the SSL Certificate requires a [restart of the appliance](https://docs.smartfile.com/filehub-on-premise/restarting-the-appliance).

## SAN Certificates & Changing Domain Names

ExaVault does not support multiple domain names with Subject Alternative Name (SAN) SSL certificates. You can upload a SAN certificate, but the web interface is only compatible with a single domain and will not function correctly when multiple domains are specified.

### Planning for Domain Changes

Take these steps to minimize the disruption of changing your installation's domain name.

Pick the switchover date. Plan the switch for a time with the lowest traffic, likely over a weekend.

Communicate with all of your users in advance. Inform them of the upcoming change, give them the new URL, and update any relevant bookmarks or login credentials. Some users may require notification through more than one channel.

Configure the new domain's DNS settings so the new records point to your ExaVault instance. Allow plenty of time for DNS propagation — 24 hours is a safe window.

Generate a new SSL certificate for the new domain and confirm it is properly validated.

Update the configuration in the ExaVault Appliance Manager at https\:// \[APPLIANCE\_IP-OR-HOSTNAME]:9002. Change the domain name on the configuration page, install the new certificate, and restart the appliance.

After restarting, confirm that the appliance is reachable at the new domain name.

Follow up with your users again to confirm the change is in place. Watch user access logs and feedback for any issues.