M Mateo's SSL Install Demo

Apache LAMP + CertPanel AutoInstall SSL

Hello world, now with SSL.

We put a simple site on a DigitalOcean LAMP server, installed CertPanel AutoInstall SSL, validated the domain with a file check, and noted what the sandbox certificate looks like in the browser.

Get your SSL today See the walkthrough
CertPanel active order with certificate issued, agent online, and automatic renewal active
Server Ubuntu 24.04 LAMP
Web Server Apache 2.4
Domain mateo.itsatest.site
Validation HTTP file validation

Walkthrough

What we did with the product

The screenshots follow the full sandbox CertPanel process, from purchase through AutoInstall instructions.

1

Selected AutoInstall SSL and PositiveSSL

We started from the AutoInstall SSL purchase screen, selected an existing domain, chose a standard certificate, and picked PositiveSSL (DV).

2

Started certificate enrollment

CertPanel showed the next steps for AutoInstall SSL and the PositiveSSL certificate, then moved into enrollment.

3

Confirmed domain and automatic install

We selected mateo.itsatest.site, chose automatic installation, and kept it to the non-www hostname because www did not resolve in DNS.

4

Installed through Apache file validation

CertPanel gave us the agent and certificate commands, the server passed HTTP file validation, and AutoInstall set up Apache SSL.

Product Screenshots

The full CertPanel sandbox sequence

Click any screenshot to open the full image.

1. Buy AutoInstall SSL Selected the existing domain and PositiveSSL (DV) certificate option.
2. Next steps CertPanel created actions for AutoInstall SSL and the PositiveSSL certificate.
3. Domain Confirmed mateo.itsatest.site as the domain to protect.
4. Installation method Chose automatic installation so CertPanel could handle the Apache setup.
5. Configure AIS Selected Apache, file validation, and mateo.itsatest.site only.
6. Install command Used the command from CertPanel to finish the install from the server terminal.

Commands

Two commands do the heavy lifting

CertPanel keeps this simple: run one command to install the AutoInstall agent, then run one more to validate the domain, install the certificate, update Apache, and get renewals ready.

Install the AutoInstall agent

sudo wget -qO - https://sb.files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash -s

Install the SSL certificate

sudo runautoinstallssl.sh installcertificate --token EXAMPLE_TOKEN --validationtype file --validationprovider filesystem

Terminal Evidence

The server-side work, step by step

These terminal views show what happened on the server: detection, setup, agent installation, certificate installation, and final verification.

1. Stack detection Confirmed Apache was active, nginx was inactive, and DNS pointed to the droplet.
2. Apache site setup Created the webroot, enabled the vhost, and verified the first HTTP 200 response.
3. Agent installation Installed the sandbox AutoInstall SSL agent and confirmed Apache/mod_ssl detection.
4. Certificate install Ran file validation, passed the CA check, and installed the certificate with Apache.
5. Final verification Verified the HTTPS response and noted the sandbox Test P-384 issuer details.

Sandbox Results

Installed successfully, but as a test certificate.

The server is not falling back to an old/default SSL certificate. Apache is serving the certificate that AutoInstall placed on disk.

What works

HTTP and HTTPS both serve the site, Apache has an enabled SSL vhost, and the certificate SAN contains mateo.itsatest.site.

What looks different

The issuer is Sectigo Limited, Test P-384 Certification Authority, and the certificate expires on Jun 06, 2026.

Why that happens

This came from sandbox.certpanel.com and the agent was installed from sb.files.autoinstallssl.com, so the chain is a test chain and is not publicly trusted.

Certificate viewer The browser confirms the sandbox issuer, dates, and fingerprint details.
View The SSL Certificate

Open the browser certificate viewer from the address bar. In this sandbox install, you should see the certificate issued to mateo.itsatest.site by Sectigo Limited's Test P-384 Certification Authority, with an expiration date of June 6, 2026.

In production, this same check should show a trusted PositiveSSL/Sectigo chain with no browser warning.

Ready for production

Use the same steps with a production CertPanel order.

The process is straightforward: choose Apache, use file validation, run the AutoInstall command, and check the trusted production certificate in the browser.

Get your SSL today

FAQ

Common SSL setup questions

Why would a business want SSL?

SSL protects the traffic between visitors and your website. It keeps forms, checkout pages, and login screens private, and helps your site avoid the “Not Secure” warning that makes people hesitate.

Why use CertPanel for this process?

CertPanel keeps the order, validation, install instructions, and renewals in one place. If your team does not want to manually manage CSRs, validation files, Apache settings, and renewal reminders, AutoInstall makes the job easier to repeat.

What are the benefits of AutoInstall SSL?

AutoInstall can detect the web server, place the validation file, install the issued certificate, update Apache, and set up renewals. That means fewer manual steps and less chance of missing a renewal. CertPanel also has a helpful guide here: Getting Started with AutoInstall SSL: Install an SSL Certificate on Linux.

Where is the official CertPanel Linux guide?

Getting Started with AutoInstall SSL: Install an SSL Certificate on Linux walks through the Linux AutoInstall process, including Apache/NGINX support, file validation, and the two-command install flow.

Is the server running nginx or Apache?

The server is running Apache. nginx was checked and was not active, so Apache was the right choice in CertPanel.

Why does the browser warn about the certificate?

This install came from CertPanel's sandbox environment, so it issued a test-chain certificate. A production CertPanel order should use a trusted chain that browsers accept without the sandbox warning.

Was there an old default SSL certificate installed?

The default Apache snakeoil certificate exists on the server, but it is not the active site. The live certificate is the one AutoInstall installed.

What did we learn along the way?

The first install command included www, but www.mateo.itsatest.site did not resolve in DNS. We removed www and installed only the main hostname. We also confirmed that sandbox orders can show PositiveSSL while still issuing a test certificate that browsers do not publicly trust.

Why did file validation work here?

The domain already pointed to the droplet, Apache served the right webroot, and the .well-known/pki-validation path was reachable. That gave the certificate authority a public URL where it could check the validation file.

When would DNS validation be better?

DNS validation is useful for wildcard certificates, locked-down web servers, or cases where HTTP validation cannot reach the server. It usually means using DNS API credentials or manually adding DNS records.

What should production show?

A production run should show a trusted PositiveSSL/Sectigo certificate chain, no browser warning, and the expected production dates.

Full Guide

Complete SSL installation SOP

This is the process we followed for the sandbox Apache install. Official reference: Getting Started with AutoInstall SSL: Install an SSL Certificate on Linux.

1. Confirm the server stack

We connected to the DigitalOcean LAMP droplet and confirmed it was running Ubuntu 24.04 with Apache active. nginx was not active, so Apache was the right option in CertPanel.

systemctl is-active apache2 httpd nginx
systemctl list-units --type=service --state=running --no-pager | grep -E "apache|httpd|nginx|mysql|mariadb|php"
ss -ltnp | grep -E ":(80|443)"
apache2ctl -S
dig +short mateo.itsatest.site A

2. Create the basic website

We created a dedicated webroot, added the validation directory, and started with a simple Hello world page.

mkdir -p /var/www/mateo.itsatest.site/public_html/.well-known/pki-validation
printf "Hello world!\n" > /var/www/mateo.itsatest.site/public_html/index.html
chown -R www-data:www-data /var/www/mateo.itsatest.site

3. Configure Apache for the domain

We added a named Apache vhost for mateo.itsatest.site, enabled it, disabled the default DigitalOcean placeholder, tested the config, and reloaded Apache.

<VirtualHost *:80>
    ServerName mateo.itsatest.site
    ServerAdmin webmaster@localhost
    DocumentRoot /var/www/mateo.itsatest.site/public_html

    <Directory /var/www/mateo.itsatest.site/public_html>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog /var/log/apache2/mateo.itsatest.site-error.log
    CustomLog /var/log/apache2/mateo.itsatest.site-access.log combined
</VirtualHost>
a2ensite mateo.itsatest.site.conf
a2dissite 000-default.conf
apache2ctl configtest
systemctl reload apache2
curl -i http://mateo.itsatest.site/

4. Prepare Apache SSL support

We enabled Apache SSL support and set a basic global ServerName to keep Apache from warning during config tests.

a2enmod ssl
printf "ServerName localhost\n" > /etc/apache2/conf-available/servername.conf
a2enconf servername
apache2ctl configtest
systemctl reload apache2

5. Install the CertPanel AutoInstall agent

CertPanel sandbox provided the agent install command. The agent installed under /opt/autoinstallssl and added the runautoinstallssl.sh command.

sudo wget -qO - https://sb.files.autoinstallssl.com/packages/linux/version/latest/get.autoinstallssl.sh | sudo bash -s
command -v runautoinstallssl.sh
runautoinstallssl.sh --help

6. Install the certificate with file validation

We used the CertPanel command for file validation. The final run did not include www because www.mateo.itsatest.site did not resolve in DNS.

sudo runautoinstallssl.sh installcertificate --token EXAMPLE_TOKEN --validationtype file --validationprovider filesystem

AutoInstall detected Apache, found the webroot, placed the validation file, waited for certificate authority validation, downloaded the certificate, and installed it into Apache.

7. Verify the installed site and certificate

We verified that HTTP and HTTPS served the page and checked the live certificate details with OpenSSL.

curl -i http://mateo.itsatest.site/
curl -k -i https://mateo.itsatest.site/
echo | openssl s_client -servername mateo.itsatest.site -connect mateo.itsatest.site:443 2>/dev/null | openssl x509 -noout -subject -issuer -dates -ext subjectAltName
subject=CN=mateo.itsatest.site
issuer=C=GB, ST=Greater Manchester, L=Salford, O=Sectigo Limited, CN=Test P-384 Certification Authority
notBefore=May  7 00:00:00 2026 GMT
notAfter=Jun  6 23:59:59 2026 GMT
X509v3 Subject Alternative Name:
    DNS:mateo.itsatest.site

8. Sandbox notes

The CertPanel UI showed PositiveSSL (DV), automatic installation, and a 31-day certificate window. Because this came from sandbox.certpanel.com and the agent came from sb.files.autoinstallssl.com, the live certificate is a sandbox test certificate. Apache is serving the AutoInstall certificate correctly; it is not serving the old Apache default certificate.

9. Production notes

For a browser-trusted PositiveSSL certificate, repeat the same steps in the production CertPanel environment with the production agent and production order token. The browser should then show a trusted PositiveSSL/Sectigo chain instead of the Test P-384 sandbox issuer.