Title: Custom TLS certificates with a non-VIP CSR
Author: WordPress VIP Documentation
Published: October 4, 2023
Last modified: June 10, 2025

---

 1. [TLS](https://docs.wpvip.com/tls/)
 2. [Install a custom TLS certificate](https://docs.wpvip.com/tls/custom-cert/)
 3. Custom TLS certificates with a non-VIP CSR

#  Custom TLS certificates with a non-VIP CSR

To install a custom TLS certificate for a domain with a CSR that was not generated
by VIP, customers must have in their possession a complete certificate chain generated
by a Certificate Authority (CA).

A complete certificate chain includes:

 * [CSR](https://letsencrypt.org/docs/glossary/#def-CSR)
 * Private key (password protected certificate keys are not supported)
 * [Leaf certificate](https://letsencrypt.org/docs/glossary/#def-leaf)
 * Trusted certificates (also known as “[Intermediate certificates](https://letsencrypt.org/docs/glossary/#def-intermediate)“)

A custom TLS certificate can be generated and installed before a [domain has been verified](https://docs.wpvip.com/domains/verification/)
and before the[ DNS for a domain is pointed to VIP](https://docs.wpvip.com/point-dns-to-vip/).

## Access

**Prerequisite**

 * Installing a TLS certificate for a domain in the VIP Dashboard requires a user
   to have at minimum an [Org member role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles/)
   or an [App write role](https://docs.wpvip.com/manage-user-access/vip-dashboard/org-roles/)
   for that application.
 * In order to successfully install a generated custom TLS certificate, it must 
   [meet all of the requirements](https://docs.wpvip.com/custom-tls-cert/requirements/).

 1. Navigate to the [VIP Dashboard](https://dashboard.wpvip.com/) for the application
    that the domain is associated with.
 2. Select the environment (e.g., production, develop that the domain points to) from
    the dropdown located at the upper left of the dashboard.
 3. Select “**Domains & TLS**” from the sidebar navigation at the left of the screen.
 4. Locate the domain for which the custom TLS certificate will be installed. If the
    domain is not yet added to the environment, add it by selecting the “**Add Domain**”
    button in the upper right of the panel and follow the prompts.
 5. Select the “**•••**” button located to the right of the domain.
 6. Select “**Install Custom Certificate**” from the overflow menu.
 7. In the message banner labeled “**Have your own CSR and Private Key?**” near the
    top of the screen, select the text “**Click here to upload**“.

![](https://docs.wpvip.com/wp-content/uploads/sites/2/2024/02/Have-Your-Own-CSR.
png?w=1024)

Example screenshot of the text “**Have your own CSR and Private Key?**” near the
top of the screen

## Upload a certificate chain

To populate the “**Upload a Certificate Chain**” fields with all four parts of the
complete certificate chain, a user can either “Copy and paste” or “Upload a PEM 
file”.

### Copy and paste

For customers who have obtained separate files for all four parts of the complete
certificate chain:

 1. Open the complete certificate chain files in a text editor.
 2. One at a time, copy the contents of a complete certificate chain file from the 
    text editor and paste the contents into its corresponding field.
 3. Repeat for all four files.
 4. Select “**Upload**“.

### Upload a PEM file

For customers who have obtained a single PEM file that contains all four parts of
the complete certificate chain:

 1. Select the linked text “**Select a PEM file**“.
 2. Select the file source from the local machine.
 3. Select the button labeled “**Upload**“.

![](https://docs.wpvip.com/wp-content/uploads/sites/2/2024/07/upload-certficate-
chain.png?w=1024)

Screenshot example of the fields for the four parts of a complete certificate chain

## Activate a custom certificate

The installation of a custom TLS certificate is not complete until it has been activated
for a domain.

### Choose your domains

After uploading a certificate chain, the user will be transferred to “Step 4 of 
5” of the “Install Custom Certificate” panel in the VIP Dashboard:

 1. Select the option below the “Domains” label that is correct for the new TLS certificate
    that is being installed:
 2.  * **Select all domains:** Selecting this option indicates that the TLS certificate
       is applicable to all domains that have been added to the environment’s “Domains”
       panel.
     * **Select specific domains:** Selecting this option will present the user with
       a dropdown list of domains that have been added to the environment’s “Domains”
       panel. Select one or more domains to which the TLS certificate should apply.
 3. Select the button labeled “**Activate Certificates**” to complete the TLS certificate
    installation and activation.

![](https://docs.wpvip.com/wp-content/uploads/sites/2/2024/07/choose-your-domains.
png?w=1024)

Example screenshot of the “Choose your domains” step and the button labeled “Activate
Certificates”

## Confirm the certificate is working

 * New TLS certificates may require up to 10 minutes to be enabled for a domain.
 * Use a free online TLS testing tool such as [SSLShopper](https://www.sslshopper.com/ssl-checker.html)
   or [DigiCert](https://www.digicert.com/help/).
 * Browsers such as [Firefox](https://support.mozilla.org/en-US/kb/secure-website-certificate)
   and [Chrome](https://support.google.com/chrome/answer/95617?hl=en) provide tools
   for checking if a site’s connection is secure.

Last updated: June 10, 2025