SSL certificates: free (Let's Encrypt) and commercial

An SSL (TLS) certificate lets your site open over HTTPS. The “Certificate SSL — gratis și comerciale” (SSL certificates — free and commercial) page (blackbox.md/domains/ssl, menu “Domenii” (Domains) → “Certificate SSL” (SSL certificates)) presents two options. A Let's Encrypt certificate is free, and you install it on the server yourself. You request a commercial certificate through support, and the BLACKBOX team sends you a quote. The app.blackbox.md panel has no section for certificates.

The blackbox.md website is available in Romanian and Russian; this article quotes the Romanian labels with their English meaning.

Available to: Let's Encrypt: anyone with root access to the server. Commercial certificate: any visitor to blackbox.md can request a quote by email or by phone, and blackbox.md account holders can also do so through a support ticket.

Which certificate you need

For most sites (blogs, brochure sites, online stores, apps and APIs), Let's Encrypt is enough. The encryption is the same as with a commercial certificate, and the browser shows the site the same way.

Choose a commercial certificate if:

• you need organization validation, meaning the company name must appear in the certificate (OV or EV);
• a contract, a bank or a payment processor requires a financial guarantee (warranty) from the CA;
• a client or partner requires a specific type of certificate or a specific certificate authority;
• you use an older system or device that doesn't accept Let's Encrypt or can't run automatic renewal.

Let's Encrypt: the free certificate

• It is issued by Let's Encrypt, a non-profit certificate authority. Let's Encrypt checks only that the domain is yours.
• It is valid for 90 days. A certbot timer renews it automatically a few weeks before it expires. On Ubuntu and Debian the timer starts on its own; on AlmaLinux and CentOS Stream you start it yourself, as the guide below shows.
• With the usual HTTP validation, the domain must already point to the server's IP address, and port 80 must be reachable from the internet. See How to point your domain to the server.
• A wildcard certificate (*.example.com) can only be obtained with DNS validation, using a _acme-challenge TXT record. For automatic renewal, use a certbot plugin for your DNS provider (for example Cloudflare). With manual validation (--manual), renewal no longer happens automatically.
• You don't need a CSR, because certbot creates one itself.

Step-by-step installation for nginx and Apache: Web server with HTTPS: nginx or Apache and Let's Encrypt.

The first command below lists the installed certificates and their expiry dates. The second simulates a renewal without issuing a new certificate.

certbot certificates
certbot renew --dry-run

Types of commercial certificates

OV and EV validation takes longer than DV validation, because the CA checks the company's documents.

How to request a commercial certificate

1. Open the “Certificate SSL — gratis și comerciale” (SSL certificates — free and commercial) page (blackbox.md/domains/ssl).
2. Click “Cere ofertă SSL comercial” (Request a commercial SSL quote) at the top of the page. The “Contacte” (Contacts) page opens.
3. Choose how to contact us: a support ticket (“Contul meu” (My account) → “Ajutor și suport” (Help and support) → “Tichet nou” (New ticket)), an email to support@blackbox.md, or a call or WhatsApp message to +373 78 003948, Monday–Friday, 09:00–18:00 (Moldova time).
4. In the ticket, in “Subiect” (Subject), write for example “Quote request: OV SSL certificate for example.com”. In “Server (opțional)” (Server (optional)), enter the name or IP address of the server where you will install the certificate.
5. In “Descrieți problema” (Describe the problem), enter the details from the table below, then click “Trimite tichetul” (Send ticket).
6. The team replies with a quote: the price and the terms.
7. Follow the validation instructions you receive. For DV, confirm that you control the domain; for OV and EV, prepare the company's documents.
8. Once the certificate is issued, you receive its files. Installation is described below.

The ticket form step by step: Opening a support ticket.

Important The “Certificate SSL” (SSL certificates) page shows indicative prices. What applies is the price and the terms in the quote you receive from the team.

The CSR and the private key

The CA issues a commercial certificate based on a CSR (Certificate Signing Request). The CSR contains the public key and the domain names. You can generate it in your browser, from “Domenii” (Domains) → “Generator CSR” (CSR generator) (blackbox.md/domains/csr). The generator shows two blocks, “Cheia privată (.key)” (Private key (.key)) and “CSR (.csr) — trimiteți la CA” (CSR (.csr) — send to the CA). With the “Descarcă” (Download) button in each block, you save them as files named after the Common Name, for example www.example.com.key. The detailed steps are in Browser-based CSR generator. Before you send the CSR, check it using the article Checking a CSR or certificate with openssl.

Security Send only the CSR. Never send the private key (.key) to anyone, not in a ticket and not by email. Keep it in a safe place: without it, the issued certificate can't be installed. If you lose it, you need a new CSR and the certificate has to be reissued.

How to install a commercial certificate

The web server configuration is the same as for Let's Encrypt. Only the file paths change. You need:

In the commands below, DOMAIN is the domain name, and DOMAIN.crt and ca-bundle.crt are the files you received. Replace them with the actual names of your files.

1. On the server, create a directory for the files:

   mkdir -p /etc/ssl/DOMAIN
   chmod 700 /etc/ssl/DOMAIN

2. Copy the files from your computer to the server (Transferring files to the server (scp, rsync, SFTP)):

   scp DOMAIN.key DOMAIN.crt ca-bundle.crt root@SERVER_IP:/etc/ssl/DOMAIN/

3. On the server, combine the certificate and the intermediate chain into a single file, with the domain certificate first. Then protect the key:

   cd /etc/ssl/DOMAIN
   cat DOMAIN.crt ca-bundle.crt > fullchain.pem
   chmod 600 DOMAIN.key

4. Point to the files in the site's configuration. For nginx, in the server block with listen 443 ssl:

   ssl_certificate     /etc/ssl/DOMAIN/fullchain.pem;
   ssl_certificate_key /etc/ssl/DOMAIN/DOMAIN.key;

   For Apache, in <VirtualHost *:443>:

   SSLCertificateFile    /etc/ssl/DOMAIN/fullchain.pem
   SSLCertificateKeyFile /etc/ssl/DOMAIN/DOMAIN.key

5. Check the configuration and reload the web server. For nginx:

   nginx -t
   systemctl reload nginx

   For Apache (the service is called apache2 on Ubuntu and Debian and httpd on AlmaLinux and CentOS Stream):

   apachectl configtest
   systemctl reload apache2 || systemctl reload httpd

Common installation errors:

If you need help with the installation, write to us: How to contact BLACKBOX support.

Checking the certificate

Run the commands on the server or on a computer with Linux or macOS. The first command checks the chain of trust: the end of its output must show “Verify return code: 0 (ok)”. The second command shows the issuer and the validity period.

openssl s_client -connect DOMAIN:443 -servername DOMAIN < /dev/null
openssl s_client -connect DOMAIN:443 -servername DOMAIN < /dev/null 2>/dev/null | openssl x509 -noout -issuer -dates

Other checks, including whether the key, the CSR and the certificate match: Checking a CSR or certificate with openssl.

Frequently asked questions

Can visitors tell the difference between Let's Encrypt and a commercial certificate? No. The browser shows the site the same way, and the issuer is visible only in the certificate details. For an online store too, Let's Encrypt provides the same encryption.

Wildcard or SAN? Choose a wildcard for many subdomains of the same domain, including ones you will create later. Choose SAN for different domains, for example example.com and example.com, which a wildcard doesn't cover.

How do I renew a commercial certificate? A commercial certificate doesn't renew automatically. Keep track of the expiry date and request the renewal through support in good time. Use a new CSR, preferably with a new key. Then replace the files and reload the web server.

I switched from Let's Encrypt to a commercial certificate. What do I do with the old certificate? Once the site uses the new certificate and no configuration still points to files in /etc/letsencrypt/live/, delete the old one so that certbot stops renewing it. You can find its exact name under “Certificate Name” in the output of the certbot certificates command.

certbot delete --cert-name DOMAIN

Why isn't the certificate issued, even though DNS is correct? Check whether the domain has CAA DNS records. If it does, they must allow the certificate authority you chose; for Let's Encrypt, the value is letsencrypt.org. For Let's Encrypt, also check that port 80 is reachable from the internet.