View source for How to install a new HTTPS Certificate

Our certificate vendor delivers certificates via email.  The email
message typically contains two certificates (in the body of the
message).

# Our website certificate
# The vendor's intermediate certificate

Save the website certificate to a file like "masspirates.org.crt.YYYY"
(where YYYY is the year where the certificate was issued).  If that
file already exists on the server, use YYYYMMDD, or similar to make
the file name unique.

Save the vendor's intermediate certificate to a file like
"masspirates.org.ca.YYYY".

Scp the files to our web server.  They go in the directory
~/masspirates.org/include/cert.

It's a good idea to verify the new certificate before installing.
First, make sure that the new certificate's modulus matches the key
modulus.

  $ openssl x509 -modulus -in masspirates.org.crt.2015 -noout | openssl md5
  (stdin)= d3b07384d113edec49eaa6238ad5ff00

  $ openssl rsa -modulus -in masspirates.org.ssls.key -noout | openssl md5
  (stdin)= d3b07384d113edec49eaa6238ad5ff00

Note that the two stdin lines match.  That means the private key and
certificate have the same modulus.  If the moduli don't match, then
you've got the wrong certificate, and it won't work.

(Note: the md5 sums above are illustrative.  They're not the actual
values)

Next, make sure the certificate file validates against the
intermediate CA.

  $ openssl verify -CAfile masspirates.org.ca.2015 masspirates.org.crt.2015 
  masspirates.org.crt.2015: OK

"OK" is the answer you want to see.

Once you've done this, go into our hosting provider's control panel,
and edit the webserver configuration.

* SSLCertificateFile should reference the new masspirates.org.crt.YYYY
* SSLCertificateChainFile should reference the new masspirates.org.ca.YYYY

Save your changes, wait a few moments for the web server to reload.
Visit https://masspirates.org and verify it looks okay.  Also verify
that the certificate expiration date is what you expect it to be.

Finally, go back to ~/masspirates.org/include/cert (on the web
server).  Move the old certificates into the "OLD" directory.