Enterprise Solution: Installing a Custom SSL Certificate
Every domain connected to Wix gets a free Secure Sockets Layer (SSL) certificate issued by Let's Encrypt or Google. If you need a certificate from a different certificate authority instead, you can generate one yourself and install it on your domain from your Wix account.
Important:
Custom SSL certificates are available on Enterprise accounts only, and need to be enabled for your account. If you don't see an SSL certificate column on your Domains page, this option isn't enabled yet.
Step 1 | Generate a private key and a CSR
A custom SSL certificate starts with 2 files that you create outside Wix: an RSA private key and a certificate signing request (CSR). You need a domain already connected to your site, and a third-party SSL provider to generate the files with, such as ZeroSSL or DigiCert.
RSA private key: A secure file that digitally signs your site's identity. Wix supports keys up to 2048 bits.
Certificate Signing Request (CSR): An encoded text file containing your domain name and your organization details, such as your business name and location.
When you generate the CSR, set its Subject Alternative Name (SAN) entries to exactly 2 domains: your domain and its www version (e.g. example.com and www.example.com). Wix rejects a certificate that covers only one of them, includes any other subdomain, or uses a wildcard.
Note:
Keep the private key somewhere safe once you generate it. You need it again in Step 4.
Step 2 | Submit your CSR to a certificate authority
Submit the CSR from Step 1 to a certificate authority (CA), which validates the details in your request and issues the certificate. Wix uses Let's Encrypt and Google for its own SSL certificates, but a custom certificate can come from any provider, including the one you used in Step 1.
Set the expiration to at least 3 months. Wix rejects certificates with less time remaining.
Step 3 | Download your certificate files
Once the CA has validated your details, download the certificate files it issues.
Your files need to meet these requirements:
Format: PEM.
Private key length: 2048 bits or shorter.
Coverage: The certificate must cover both your domain and its www version (e.g. example.com and www.example.com), and no other domains.
Validity: At least 3 months remaining.
Step 4 | Combine your files into one PEM file
Wix reads your whole certificate chain as one block of text, so combine your files into a single document before you install them.
Include all 4 components in this order, each wrapped in its own -----BEGIN----- and -----END----- markers:
Your private key.
Your primary SSL certificate.
Your intermediate certificate (or certificates).
Your root certificate.
The combined file looks like this:
-----BEGIN RSA PRIVATE KEY-----
Your private key: your_domain_name.key
-----END RSA PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
Your primary TLS/SSL certificate: your_domain_name.crt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Your intermediate certificate: for example DigiCertCA.crt
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
Your root certificate: TrustedRoot.crt
-----END CERTIFICATE-----Note:
Keep the ----- dashes exactly as they appear. Wix can't read the file without them.
Step 5 | Install the certificate on your domain
Paste the combined file into your Wix account to install it on the domain.
To install the certificate:
Go to Domains in your Wix account.
Click the Domain Actions icon
next to the relevant domain.
Click Install SSL certificate, or Update SSL certificate if the domain already uses a third-party certificate.
Paste your combined PEM file from Step 4 into the field.
Click Install certificate (or Update).
FAQs
Click a question below to learn more about custom SSL certificates.
Does Wix generate the CSR for me?
No. Wix doesn't create private keys or CSR files. You generate both with a third-party SSL provider before you request a certificate.
Why does my certificate get rejected?
The panel shows an error under the field naming the problem. The most common causes are a certificate that expires in less than 3 months, a certificate that doesn't cover both your domain and its www version, a certificate that covers any additional domain or uses a wildcard, a private key longer than 2048 bits, or a missing component such as the intermediate or root certificate.
What happens if I don't replace my custom certificate before it expires?
About 20 days before your custom certificate expires, Wix issues a new certificate for the domain through Let's Encrypt or Google. Your site stays secure, but it stops using your custom certificate.
There is one exception. If your domain has a Certification Authority Authorization (CAA) record that doesn't list Let's Encrypt or Google as permitted issuers, Wix can't issue that replacement. Install a new custom certificate before the current one expires, or your site becomes insecure when it does.
Can I go back to the certificate Wix provides?
There's no option in the panel to remove a custom certificate on demand. Wix takes over again at renewal, issuing its own certificate through Let's Encrypt or Google about 20 days before your custom one expires, unless a CAA record on your domain prevents it.
Does this apply to my subdomains?
No. A custom certificate covers exactly 2 domains: your domain and its www version. A certificate that includes any other subdomain, or a wildcard such as *.example.com, is rejected.
Tip:
You can also read more about how HTTPS and SSL protect your site, or about the other ways to transfer, connect and assign domains in your account.