I have generated a free SSL from zerossl.com through their wizard, and finally I got a pure text file containing pure text with two BEGIN and END.

I want to know how to generate .crt and key from that file/text.

I have three text files:

domain-csr, account-key, domain-crt

Here's the guide from the site:

Your certificate is ready! Congratulations on receiving your Free SSL Certificate. Please note that certificates are valid for 90 days, but they are free to renew. To renew just repeat the process, using the same LE key and CSR as you used last time. Using the same CSR means that you do not need a new domain key (it will stay the same) and will only need to update the certificate file on your server. Keep your keys and CSR safe. Make sure you remember where you saved your generated account key!

Your account ID is 48546566 - please write it down somewhere. You will not normally need this, but together with email it might help you to restore your account quicker if you lose your account key.


When installing the certificate, keep in mind that it should be used with the domain key, NOT the LE key from the "Details" screen. The LE key should be only used on the "Details" screen when issuing or renewing your certificate. On renewal that will allow you to skip the verification of already verified domains. Your certificate file contains both your domain certificate and the issuer's certificate. Most modern web servers will accept them as is. However, old versions of Apache, Amazon Web Services (AWS) and some control panels would want them separately. In that case just split the certificate file in two, preserving BEGIN and END lines around both certificates. The first one is your domain certificate, the second one is the issuer's, which in control panel interface may be called "Intermediate certificate", "Certificate chain" or "CA Bundle".

  • You already generated them. Now you download them and install them on your web server. – Michael Hampton Dec 28 '18 at 18:28
  • @MichaelHampton, they're text files !! – CairoCoder Dec 28 '18 at 18:28

You can't get the private key out of a certificate - the certificate is public. Being able to do so would render SSL certificates useless.

It looks like ZeroSSL will offer to create a private key for you. If you did that (you shouldn't; you should generate it yourself and provide them with a CSR; it's a security risk to let someone else generate/manage your private key, and an avoidable one in this case):


I do not see my domain key on the last step. How do I get it?

If you have generated the CSR on the first step of the process, then on the last step the domain key will certainly be present, along with the certificate file. However, if you are renewing and using the same CSR as before, or if you are using a CSR generated elsewhere, then on the last step you will only see the certificate, but not the corresponding domain key. This is because having the CSR means that you already have the key and extracting it from the CSR to show it to you is not possible anyway.

  • I have three text files: domain-csr, account-key, domain-crt how could I use them? – CairoCoder Dec 28 '18 at 18:33
  • @CairoCoder Per the screenshots at community.letsencrypt.org/t/…, there should be a download of the private key if you let ZeroSSL generate it. Why not just use Let's Encrypt directly, though, and avoid all this? – ceejayoz Dec 28 '18 at 18:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.