Understanding SSL Certificate Files: CSR, Key, CRT, CA-Bundle, and PFX

This article is intended for customers who want to understand the different components of an SSL certificate and when each is required. It applies whether you are using the free AutoSSL feature in cPanel, purchasing a commercial SSL certificate through the Maxer client area, or installing an SSL certificate on an external server.

SSL certificates involve several files that work together to secure your website and encrypt data. Knowing what each file does can help you install, transfer, or troubleshoot your certificate.

CSR (Certificate Signing Request)

• Purpose: A CSR is a file containing information about your domain and organisation, including the public key that will be part of your SSL certificate.

• When needed:

  • When you purchase a commercial SSL certificate (unless generated automatically during the ordering process).

  • For certificates purchased through the Maxer client area, the CSR may be generated automatically or you may be asked to provide one, depending on the SSL certificate.

• Where to get it:

  • In cPanel, you can generate a CSR under SSL/TLS > Certificate Signing Requests (CSR).

  • On external servers, CSRs can be generated using tools such as OpenSSL.

Private Key (.key)

• Purpose: The private key is a secret file that works with your SSL certificate to enable encrypted communication. It must be kept secure and never shared.

• When needed:

  • Always required when installing an SSL certificate.

  • If using AutoSSL in cPanel, the private key is stored securely on the server.

  • If you install the SSL certificate on another server, you must have the matching private key.

  • In cPanel, you can find the private keys under SSL/TLS > Private Keys (KEY).

• Important: Without the correct private key, your SSL certificate will not work. If you've lost the private key, the SSL certificate will need to be re-issued.

Certificate File (.crt)

• Purpose: The certificate file contains the actual SSL certificate issued by the Certificate Authority (CA).

• When needed:

  • Required for installation along with the private key.

  • Issued after the CSR is validated by the CA.

• Where to get it:

  • From the Certificate Authority or from us if purchased through the Maxer client area.

  • AutoSSL installs and renews certificates automatically, so no manual .crt handling is needed in that case.

  • In cPanel, you can find the certificates under SSL/TLS > Certificates (CRT).

CA Bundle (.ca-bundle)

• Purpose: The CA bundle contains one or more intermediate certificates that establish trust between your SSL certificate and the root certificate of the CA.

• When needed:

  • Some servers require the CA bundle to complete the trust chain.

  • cPanel usually installs the CA bundle automatically.

  • If installing on another platform, you may need to upload it manually.

• Where to get it:

  • Provided by the CA or included in the SSL certificate ZIP package.

  • Can also be downloaded from the CA’s website.

PFX / PKCS#12 File (.pfx or .p12)

• Purpose: A PFX file is a single, password-protected file containing your private key, certificate, and optionally the CA bundle.

• When needed:

  • When importing an SSL certificate into systems like Microsoft IIS, Exchange, Tomcat, or Windows servers.

  • When transferring a certificate between platforms that require a single-file format.

• How to create it:

  • You will need your private key, certificate, and CA bundle.

  • See our Guide: How to Generate a PFX File on Windows, Linux, and macOS for detailed steps.

SSL Certificates on Our Hosting

On our servers:

• AutoSSL in cPanel automatically issues and renews free SSL certificates for all domains pointing to our servers.

• Commercial SSL certificates purchased via the Maxer client area:

  • Some certificates are automatically provisioned and installed on your cPanel account.

  • Others may require you to install the certificate manually, either in cPanel or on an external server.

If your SSL certificate will be installed externally (for example, on a different hosting platform or a mail server), we can provide all required files (CSR, private key, certificate, CA bundle) upon request.

Related Articles

• How to Generate a PFX File on Windows, Linux, and macOS

• Accessing your hosting control panel (cPanel)

Updated by SP on 15/08/2025