> For the complete documentation index, see [llms.txt](https://docs.exavault.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.exavault.com/administration/installing-or-updating-an-ssl-certificate.md). # Installing or Updating an SSL Certificate Transport Layer Security (TLS), formerly called Secure Sockets Layer (SSL), encrypts a connection between a client and the ExaVault appliance. The certificate presented by the appliance identifies the server to the client and provides the public key used to establish that encrypted connection. A new ExaVault installation includes a self-signed certificate. The appliance can operate with this certificate and the connection is still encrypted, but most client programs cannot independently verify who issued it. They may display a warning or reject the connection until the certificate is trusted. ExaVault serves whichever certificate is active on the appliance for HTTPS and FTPS connections. We recommend replacing the default certificate with a publicly trusted certificate, either through automatic SSL certificate management or by installing your own certificate and its complete certificate chain. ## What the Certificate Protects The active certificate is presented for connections that use TLS: * The ExaVault web interface over HTTPS on port `443` * WebDAV over HTTPS on port `443` * Explicit FTPS on port `21` and implicit FTPS on port `990` * The Appliance Manager over HTTPS on port `9002` For those connections, TLS protects credentials, commands, directory listings, and file contents while they travel between the client and the appliance. The certificate does not encrypt files stored on disk. SFTP does not use this certificate. SFTP uses SSH encryption instead. Plain FTP does not use TLS and sends credentials, commands, and file contents without encryption. Adding a certificate on the Appliance Manager's *Trusted CA* tab is separate from choosing the certificate that ExaVault presents to clients. You do not need to add the active server certificate to *Trusted CA* for HTTPS, WebDAV, or FTPS to use it. ## Choosing a Certificate You can keep or generate a self-signed certificate, use automatic SSL certificate management, or upload a certificate issued by your organization's certificate authority. Choose based on how clients establish trust: * Use a self-signed certificate only when every client can be configured to trust it securely. * Use automatic management when the appliance can meet the DNS and inbound validation requirements and you want ExaVault to handle issuance and renewal. * Upload your own certificate when your organization manages certificates itself or requires a particular certificate authority. ## Automatic SSL Certificate Management A [Premium](/premium-features.md) plan unlocks [automatic SSL certificate management](/premium-features.md#automatic-ssl-certificate-management). When enabled, ExaVault registers and renews a publicly trusted certificate for your domain through Let's Encrypt. Before enabling automatic management, confirm that the hostname configured in the Appliance Manager resolves to the appliance and that inbound port `80` can reach it. Let's Encrypt uses that path to validate control of the hostname. After issuance or renewal, ExaVault applies the updated certificate to the services that use it. If automatic issuance does not complete, check DNS resolution, inbound port `80`, the configured hostname, and the appliance logs under `/data/exavault/logs/`. ## Installing Your Own Certificate Manage and update the site's SSL certificate with the ExaVault Appliance Manager. The certificate must be a single, unencrypted PEM file containing these components in order: * Certificate * Intermediate/Certificate Authority Certificate(s) * Private Key ### Create a Combined PEM File on macOS or Linux In a terminal, combine the three components: ```bash cat certificate.pem bundle.pem private-key.pem > combined-certificate.pem ``` ### Creating a Combined PEM File on Windows On Windows, create a new file in Notepad and save it with a `.pem` extension. Copy the contents of each file into the Notepad file in the following order: * Certificate * Intermediate/Certificate Authority Certificate(s) * Private Key ### Installation Open the ExaVault Appliance Manager at `https://:9002/`. After logging in, open *HTTP SSL*. Under *Domain Cert*, select *Choose File* to upload the PEM file, then select *Add Domain Cert*. Modifying the SSL Certificate requires a [restart of the appliance](/administration/restarting-the-appliance.md). After the certificate is active, connect to the web interface, WebDAV, and FTPS using the hostname named in the certificate. Verify that the client receives the expected certificate, that the certificate is within its validity period, and that the client can build a complete chain to a trusted certificate authority. ## Troubleshooting Certificate Warnings An `untrusted`, `unknown`, or `self-signed` warning usually means the client does not trust the issuer. A `hostname mismatch` means the client connected using a name or IP address that the certificate does not cover. An `incomplete chain` warning means one or more intermediate certificates are missing from the uploaded PEM file. An `expired certificate` warning means the active certificate must be renewed or replaced. Inspect the certificate presented by the affected service rather than assuming the upload succeeded. A browser can inspect the HTTPS certificate, while an FTP client can display the certificate presented by FTPS. If only one client fails, compare its certificate trust store and TLS support with a working client. ## SAN Certificates and Changing Domain Names ExaVault does not support multiple domain names with Subject Alternative Name (SAN) SSL certificates. You can upload a SAN certificate, but the web interface is only compatible with a single domain and will not function correctly when multiple domains are specified. ### Planning for Domain Changes Take these steps to minimize disruption when changing the installation's domain name: 1. Choose a low-traffic maintenance window for the change. 2. Tell users about the change in advance and provide the new URL. Identify integrations, bookmarks, and saved connection profiles that also need the new hostname. 3. Point the new domain's DNS records to the ExaVault appliance. Allow enough time for the records to propagate before the maintenance window. 4. Obtain and validate a certificate for the new domain. 5. Open the Appliance Manager at `https://:9002/`. Change the hostname on the *Configuration* page, install the new certificate, and restart the appliance. 6. Confirm that the web interface and each enabled transfer protocol are reachable at the new hostname. 7. Tell users that the change is complete, then monitor Activity records and user reports for problems.