How to Install a Custom Namecheap SSL Certificate on Hostinger

Hostinger’s one-click Let’s Encrypt certificates work fine for standard sites, but they fall short the moment you need commercial validation or complex wildcard routing. If a client hands you a Sectigo EV certificate, or you picked up a multi-domain PositiveSSL package from Namecheap, you have to skip Hostinger’s automatic toggles and install everything by hand.

The process isn’t difficult, but it’s easy to trip over intermediate chain issues or mismatched private keys. Here is how I generate the keys, activate the certificate on Namecheap, bundle the chain, and wire it up inside Hostinger’s hPanel without breaking existing traffic.

Why Install a Custom Certificate Instead of Free Let’s Encrypt?

For most simple sites, Hostinger’s automated Let’s Encrypt setup is plenty. LiteSpeed provisions the cert in a minute or two and automatically handles the 90-day renewal cycle. But that setup falls apart under specific operational constraints:

• Organization (OV) and Extended Validation (EV): Let’s Encrypt only does Domain Validation (DV). If your client runs an e-commerce platform or enterprise portal that demands legal entity verification in the cert metadata, you have to buy a commercial cert.
• Wildcard and Multi-Domain (SAN) Bundles: Juggling individual automated renewals across staging setups and varied subdomains gets fragile. A single wildcard bundle from Namecheap keeps all endpoints under one umbrella.
• Longer Renewal Cycles: 90-day automated renewals are great until an automated cron fails or DNS changes cause verification to stall. Commercial certs give you a 1-year operational window.

If your DNS isn’t managed on Hostinger, make sure you know how to point a subdomain to Hostinger using Namecheap DNS before you start generating keys.

Generate Your Private Key and CSR Locally

Do not use web-based CSR generators. Handing your private key creation to a third-party website is a massive security risk. Generate the pair locally on your machine using OpenSSL.

Run this command in your terminal to create a 2048-bit RSA private key along with the Certificate Signing Request (CSR):

openssl req -new -newkey rsa:2048 -nodes -keyout example.key -out example.csr

OpenSSL will ask you a series of questions. The critical field here is the Common Name: set this to your exact domain (e.g., example.com or *.example.com if you’re deploying a wildcard). When it prompts for a challenge password, just hit Enter to leave it blank.

Here is what my terminal looks like during this prompt:

Country Name (2 letter code) [AU]: US
State or Province Name (full name) [Some-State]: Texas
Locality Name (eg, city) []: Austin
Organization Name (eg, company) [Internet Widgits Pty Ltd]: Acme Labs LLC
Organizational Unit Name (eg, section) []: Infrastructure
Common Name (e.g. server FQDN or YOUR name) []: example.com
Email Address []: admin@example.com
A challenge password []:
An optional company name []:

This creates two files in your directory: example.key (your private key) and example.csr (the request payload Namecheap requires). Keep that .key file safe and don’t share it with anyone.

Activate the Certificate Inside Namecheap

Jump into your Namecheap account, head to your SSL Certificates list, and hit Activate next to your new cert. Namecheap will prompt you for the CSR.

Dump the CSR contents to your terminal and copy the entire block, including the header and footer tags:

cat example.csr

Paste that block into Namecheap. The dashboard should parse out your Common Name and organization details immediately. For the web server type, pick Apache or Other (LiteSpeed uses standard Apache-formatted PEM bundles).

Next comes Domain Control Validation (DCV). You’ll have three options:

1. Email Validation: Verification emails sent to fixed administrative addresses like admin@example.com.
2. HTTP-based: Dropping a custom text file into your site’s .well-known/pki-validation/ directory.
3. DNS CNAME: Adding a unique CNAME record to your domain’s DNS manager.

Always pick DNS CNAME if you can. It doesn’t rely on an active mail server, and it avoids issues with aggressive web-server caching or redirect loops. If you run custom DNS constraints, make sure you know how to configure CAA records in Namecheap DNS so Sectigo or Comodo is actually permitted to issue the certificate.

Assemble the CRT and CA-Bundle Files

Once Namecheap verifies your domain, download the certificate .zip archive and unpack it. Inside, you’ll generally find:

• example_com.crt (Your primary domain certificate)
• example_com.ca-bundle (Or separate files like SectigoRSADomainValidationSecureServerCA.crt and USERTrustRSAAAACA.crt)

Hostinger requires your main certificate and the Certificate Authority (CA) chain. If Namecheap supplied individual intermediate files rather than a single unified bundle, merge them into one file via your terminal.

Run this command to build the bundle in the proper hierarchical order:

cat SectigoRSADomainValidationSecureServerCA.crt USERTrustRSAAAACA.crt > intermediate.ca-bundle

Leave your primary CRT file out of this bundle; it belongs in its own field. Per the MDN TLS documentation, the intermediate chain must only include intermediate and root certificates that link your cert back to a trusted root authority.

Install the Custom SSL in Hostinger hPanel

Now that you have your private key, domain CRT, and CA bundle ready, it’s time to upload them to Hostinger.

1. Log in to Hostinger hPanel.
2. Go to Websites > click Manage next to your site.
3. Look at the left sidebar, expand Security, and select SSL.
4. If you have an active Let’s Encrypt certificate running on the domain, click the three-dots menu next to it and hit Uninstall first.
5. Scroll down to the Custom SSL panel and click Install Custom SSL.

The modal will prompt you for three inputs:

• Certificate (CRT): Open example_com.crt in your editor or run cat example_com.crt. Copy every line from -----BEGIN CERTIFICATE----- down to -----END CERTIFICATE----- and paste it here.
• Certificate Private Key (KEY): Open the example.key file you created earlier. Copy the entire file—including the BEGIN RSA PRIVATE KEY (or BEGIN PRIVATE KEY) lines—and paste it in.
• Certificate Authority Bundle (CABUNDLE): Open example_com.ca-bundle, copy the text, and paste it into the third box.

Click Install. Hostinger will run a quick math check to ensure the private key corresponds to the public key in your CRT file. If the moduli don’t match, hPanel will throw an error immediately.

If the upload hangs or fails, take a look at our troubleshooting steps to fix SSL installation failed on Hostinger WordPress.

Verify the Chain and Enforce HTTPS

Don’t just open your site in Chrome and assume everything is fine. Desktop browsers often cache intermediate certs locally via AIA fetching, so your site might look valid on your laptop while throwing security warnings on mobile devices.

Test the actual raw TLS handshake directly from your terminal:

openssl s_client -connect example.com:443 -servername example.com

Check the chain output carefully:

Certificate chain
0 s:CN = example.com
i:C = US, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
1 s:C = US, O = Sectigo Limited, CN = Sectigo RSA Domain Validation Secure Server CA
i:C = US, ST = New Jersey, L = Jersey City, O = The USERTRUST Network, CN = USERTrust RSA Certification Authority
Verify return code: 0 (ok)

A return code of 0 (ok) confirms LiteSpeed is serving the full intermediate chain properly.

Now enforce HTTPS. Go back to Security > SSL in hPanel and turn on the Force HTTPS toggle. Or, if you manage your rewrites via Apache directives, drop this into your .htaccess file:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Finally, inspect your console for mixed-content warnings. If older assets are still serving over HTTP, our walkthrough shows you how to fix WordPress mixed content warnings after SSL on Hostinger.

The Gotcha: Certificate and Key Modulus Mismatch

The error that trips people up most often is hPanel’s generic message: “The private key does not match the certificate.”

This happens when you run OpenSSL more than once—maybe you made a typo in the CSR details, regenerated the key, but accidentally pasted the old key into Hostinger. Before wasting time pasting files back and forth, check the MD5 checksums of the moduli.

Run these two commands against your local files:

openssl x509 -noout -modulus -in example_com.crt | openssl md5
openssl rsa -noout -modulus -in example.key | openssl md5

Compare the hashes output in your terminal:

(stdin)= a4c89f2d1e7b6534892e8df928c04b12
(stdin)= a4c89f2d1e7b6534892e8df928c04b12

Those two MD5 strings must match identically. If they don’t, that private key did not generate the CSR used to issue that CRT. You can’t salvage a lost private key; you’ll have to go back to Namecheap, hit Reissue, and submit a new CSR using a fresh keypair.

Frequently Asked Questions

Do custom SSL certificates renew automatically in Hostinger?

No. Hostinger has no API connection to your Namecheap account. When the certificate approaches its one-year expiration mark, you have to buy a renewal or reissue it in Namecheap, grab the new CRT and bundle, and upload them to hPanel manually.

Will my site experience downtime when replacing the certificate?

No. LiteSpeed updates the certificates in memory without dropping active TCP connections. The switch is seamless and takes less than a second once hPanel validates the keys.

Why does Hostinger say my CA-Bundle is optional?

hPanel labels it optional because some browsers will attempt to fetch missing intermediate certs via Authority Information Access (AIA). But relying on that adds 200–400ms of latency to the initial handshake, and command-line clients (like cURL or API consumers) will outright reject the connection as untrusted. Always paste the bundle.

Can I install a Namecheap SSL if my domain uses Cloudflare?

Yes. If your DNS is proxied through Cloudflare (orange-clouded), set Cloudflare’s SSL/TLS encryption mode to Full (Strict). Hostinger will serve your custom Namecheap cert to Cloudflare’s edge, which validates it cleanly. For more edge-routing workflows, read how to configure end-to-end SSL across Namecheap and edge layers.

To lock down your certificate authority permissions across your domain, take a look at our guide on how to configure CAA records in Namecheap DNS.

Official resources

• OpenAI API documentation