Installing an SSL Certificate in BitrixVM 9: Using the Built-In Menu and Manual Configuration
An SSL certificate in BitrixVM can be installed using the built-in virtual machine tools or manually through the Nginx configuration.
In most cases, it is recommended to use the BitrixVM menu. It automatically connects the certificate to the required website and reduces the risk of configuration errors.
Manual installation may be required for non-standard server configurations or when the certificate must be connected in a way that is not supported by the standard wizard.
Let us look at both methods using BitrixVM 9.
Private Key — the private key;
Certificate — the website certificate;
Certificate Chain — the intermediate certificate chain.
For example:
The private key must not be password-protected.
A separate chain file is not required if the intermediate certificates are already included in the certificate file.
You can check the domain IP address, for example, with:
If you prefer nano, you can install it with:
Save them to:
If the chain is already included in the certificate file, BitrixVM does not require a separate chain file.
the certificate subject;
the issuer;
the start date;
the expiration date.
You can compare the public keys.
For the certificate:
If the values are different, the certificate and private key do not belong to the same pair.
Start the menu:
For this example, enter:
Sitename:
Confirm the operation after entering the parameters.
BitrixVM will install the certificate and update the website configuration automatically.
For example:
This is especially important for the private key.
If the files were placed directly in the BitrixVM certificate directory and are used by the system, they must not be deleted.
However, the certificate can also be connected directly through the Nginx configuration if necessary.
You will need:
a certificate or fullchain file;
a private key without password protection.
The website certificate must come first, followed by the intermediate certificates:
If necessary, you can perform a full restart:
After updating BitrixVM or changing website settings, some standard Nginx configuration files may be regenerated.
For this reason, manual configuration should be used only when the standard BitrixVM certificate installation wizard is not suitable.
After a BitrixVM update, it is also recommended to verify that the custom SSL configuration is still being included.
In BitrixVM, HTTPS settings are managed through the site configuration menu.
In BitrixVM 9, open:
Before disabling HTTP, make sure a trusted SSL certificate has already been installed and works correctly.
Use the following menu path:
BitrixVM will then issue and install the certificate automatically.
Let's Encrypt is suitable for most standard websites when there is no requirement to use a certificate from a specific certificate authority.
You must monitor their expiration date yourself.
After receiving a renewed certificate, import it again using:
In this case, Nginx cannot use the certificate. Compare the public keys before installation.
The private key is encrypted.
BitrixVM expects a private key without password protection.
The intermediate certificate chain is missing.
The website may open correctly in one browser and show a trust error in another. Use a valid certificate chain or fullchain.
The certificate was issued for another domain.
Check the SAN entries in the certificate.
Nginx no longer starts after manual configuration.
Always run:
2. Make sure all files are in PEM format.
3. Verify that the certificate matches the private key.
4. Run /root/menu.sh.
5. Open 9 → 2 → 2. Configure own certificate.
6. Specify the website and full paths to the certificate files.
7. Confirm the installation.
8. Check the configuration with nginx -t.
9. Open the website over HTTPS and verify the certificate.
10. Enable forced HTTPS if required.
For a standard BitrixVM installation, it is preferable to install your own SSL certificate using the built-in menu. Manual Nginx configuration should be reserved for non-standard cases.
Back to blog
In most cases, it is recommended to use the BitrixVM menu. It automatically connects the certificate to the required website and reduces the risk of configuration errors.
Manual installation may be required for non-standard server configurations or when the certificate must be connected in a way that is not supported by the standard wizard.
Let us look at both methods using BitrixVM 9.
What you need for the installation
To install your own SSL certificate, you usually need the following files:Private Key — the private key;
Certificate — the website certificate;
Certificate Chain — the intermediate certificate chain.
For example:
example.com_privkey.pem
example.com_cert.pem
example.com_chain.pem
BitrixVM expects certificates in PEM format.The private key must not be password-protected.
A separate chain file is not required if the intermediate certificates are already included in the certificate file.
Check the domain before installation
Before enabling SSL, make sure the website has already been created in BitrixVM and the domain points to the correct server.You can check the domain IP address, for example, with:
dig +short example.com
or:
nslookup example.com
The returned IP address should match the server where the website is hosted.
Installing the nano editor
BitrixVM 9 uses vi as the standard console editor.If you prefer nano, you can install it with:
dnf install nano -y
This step is optional.
Create a directory for certificate files
Create a separate directory:
mkdir -p /home/bitrix/ssl
Then switch to it:
cd /home/bitrix/ssl
We will temporarily place the certificate, private key, and certificate chain in this directory.
Create the certificate file
If the certificate authority provides the certificate and chain in one file, the first section is usually the domain certificate itself:
-----BEGIN CERTIFICATE-----
...
-----END CERTIFICATE-----
Create the file:
nano /home/bitrix/ssl/example.com_cert.pem
Paste the website certificate into it.
Create the certificate chain file
The certificate authority also provides intermediate certificates that are required to build the trusted certificate chain.Save them to:
nano /home/bitrix/ssl/example.com_chain.pem
If your provider already supplied a separate file such as chain.pem, it can be used without modification.If the chain is already included in the certificate file, BitrixVM does not require a separate chain file.
Create the private key file
A private key usually looks like this:
-----BEGIN PRIVATE KEY-----
...
-----END PRIVATE KEY-----
or:
-----BEGIN RSA PRIVATE KEY-----
...
-----END RSA PRIVATE KEY-----
Save it to:
nano /home/bitrix/ssl/example.com_privkey.pem
The private key must match the certificate being installed.
Restrict access to the private key
Because the private key is the secret part of the certificate, access to it should be restricted:
chmod 600 /home/bitrix/ssl/example.com_privkey.pem
The certificate and chain can remain readable:
chmod 644 /home/bitrix/ssl/example.com_cert.pem
chmod 644 /home/bitrix/ssl/example.com_chain.pem
Check the certificate
Before installing the certificate, verify that OpenSSL can read the PEM file:
openssl x509 \
-in /home/bitrix/ssl/example.com_cert.pem \
-noout \
-subject \
-issuer \
-dates
The command displays:the certificate subject;
the issuer;
the start date;
the expiration date.
Check that the certificate matches the private key
One of the most common mistakes is attempting to install a certificate together with a private key from another certificate.You can compare the public keys.
For the certificate:
openssl x509 \
-in /home/bitrix/ssl/example.com_cert.pem \
-pubkey \
-noout \
| openssl pkey -pubin -outform der \
| sha256sum
For the private key:
openssl pkey \
-in /home/bitrix/ssl/example.com_privkey.pem \
-pubout \
-outform der \
| sha256sum
The hashes must match.If the values are different, the certificate and private key do not belong to the same pair.
Installing SSL through the BitrixVM menu
You can now use the standard BitrixVM wizard.Start the menu:
/root/menu.sh
Open:
9. Manage pool web servers
Then:
2. Configure certificates
And select:
2. Configure own certificate
Enter the certificate information
The wizard will request the certificate parameters.For this example, enter:
Sitename:
example.com
Private Key path:
/home/bitrix/ssl/example.com_privkey.pem
Certificate path:
/home/bitrix/ssl/example.com_cert.pem
Certificate Chain path:
/home/bitrix/ssl/example.com_chain.pem
If the certificate chain is already included in the certificate file, a separate Certificate Chain file is not required.Confirm the operation after entering the parameters.
BitrixVM will install the certificate and update the website configuration automatically.
Can the certificate be installed for multiple sites?
BitrixVM allows multiple sites to be specified separated by commas.For example:
example.com,www.example.com
The certificate must be valid for all specified domain names.
Check the Nginx configuration
After installation, it is recommended to verify the web server configuration:
nginx -t
With a valid configuration, you should see output similar to:
syntax is ok
test is successful
If Nginx reports an error, do not restart the service until the problem has been fixed.
Check the installed certificate
The easiest way is to open the website:
https://example.com
You can also check the certificate from the command line:
openssl s_client \
-connect example.com:443 \
-servername example.com
For more compact output, display only certificate information:
openssl s_client \
-connect example.com:443 \
-servername example.com \
</dev/null 2>/dev/null \
| openssl x509 \
-noout \
-subject \
-issuer \
-dates
This confirms that the server is actually returning the new certificate rather than an old or self-signed one.
What to do with the source files after installation
If a temporary directory was used for the installation:
/home/bitrix/ssl/
the original files should be deleted from the server or moved to secure storage after the certificate has been successfully imported.This is especially important for the private key.
If the files were placed directly in the BitrixVM certificate directory and are used by the system, they must not be deleted.
Manual certificate installation
In most cases, the built-in BitrixVM menu should be preferred.However, the certificate can also be connected directly through the Nginx configuration if necessary.
You will need:
a certificate or fullchain file;
a private key without password protection.
Create a fullchain file for Nginx
If the website certificate and intermediate certificates are stored in separate files, they can be combined.The website certificate must come first, followed by the intermediate certificates:
cat example.com_cert.pem example.com_chain.pem > example.com_fullchain.pem
The resulting file will be used in the ssl_certificate directive.
Copy the certificates to the Nginx directory
For example:
cp example.com_fullchain.pem /etc/nginx/ssl/
cp example.com_privkey.pem /etc/nginx/ssl/
Restrict access to the private key:
chmod 600 /etc/nginx/ssl/example.com_privkey.pem
Create a custom SSL configuration
Copy the standard BitrixVM SSL configuration:
cp /etc/nginx/bx/conf/ssl.conf \
/etc/nginx/bx/conf/custom_ssl.conf
Open the new file:
nano /etc/nginx/bx/conf/custom_ssl.conf
Remove the standard certificate lines from the copy:
ssl_certificate /etc/nginx/ssl/cert.crt;
ssl_certificate_key /etc/nginx/ssl/cert.key;
Find the configuration for the required website
For the default website, the HTTPS configuration is usually located in:
/etc/nginx/bx/site_enabled/ssl.s1.conf
Additional websites typically use files such as:
/etc/nginx/bx/site_enabled/bx_ext_ssl_example.com.conf
Before editing the file, create a backup:
cp /etc/nginx/bx/site_enabled/bx_ext_ssl_example.com.conf \
/root/bx_ext_ssl_example.com.conf.backup
Connect the custom SSL configuration
Find the line:
include bx/conf/ssl.conf;
Replace it with:
include bx/conf/custom_ssl.conf;
Then add the paths to your certificate and private key:
ssl_certificate /etc/nginx/ssl/example.com_fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com_privkey.pem;
Check the configuration before applying it
This step is mandatory when configuring Nginx manually:
nginx -t
If the test is successful, apply the configuration:
systemctl reload nginx
A reload is usually sufficient for applying SSL configuration changes because Nginx reloads its configuration without fully stopping the service.If necessary, you can perform a full restart:
systemctl restart nginx
Important note about manual BitrixVM configuration
BitrixVM configuration files are managed by the virtual machine itself.After updating BitrixVM or changing website settings, some standard Nginx configuration files may be regenerated.
For this reason, manual configuration should be used only when the standard BitrixVM certificate installation wizard is not suitable.
After a BitrixVM update, it is also recommended to verify that the custom SSL configuration is still being included.
Redirecting the website to HTTPS
Installing an SSL certificate does not necessarily mean that the HTTP version of the website will automatically be disabled.In BitrixVM, HTTPS settings are managed through the site configuration menu.
In BitrixVM 9, open:
8. Configure pool sites
then:
5. Change a site's https settings
This option allows you to configure the website to work only over HTTPS.Before disabling HTTP, make sure a trusted SSL certificate has already been installed and works correctly.
If you do not have your own certificate
BitrixVM can automatically issue free Let's Encrypt certificates.Use the following menu path:
9. Manage pool web servers
→ 2. Configure certificates
→ 1. Configure "Let's encrypt" certificate
You will need to specify the website, domain names, and a contact email address.BitrixVM will then issue and install the certificate automatically.
Let's Encrypt is suitable for most standard websites when there is no requirement to use a certificate from a specific certificate authority.
Renewing your own certificate
BitrixVM does not automatically reissue third-party certificates.You must monitor their expiration date yourself.
After receiving a renewed certificate, import it again using:
9. Manage pool web servers
→ 2. Configure certificates
→ 2. Configure own certificate
You can check the current certificate validity period with:
openssl s_client \
-connect example.com:443 \
-servername example.com \
</dev/null 2>/dev/null \
| openssl x509 -noout -dates
Common SSL installation errors
The certificate and private key do not match.In this case, Nginx cannot use the certificate. Compare the public keys before installation.
The private key is encrypted.
BitrixVM expects a private key without password protection.
The intermediate certificate chain is missing.
The website may open correctly in one browser and show a trust error in another. Use a valid certificate chain or fullchain.
The certificate was issued for another domain.
Check the SAN entries in the certificate.
Nginx no longer starts after manual configuration.
Always run:
nginx -t
before reloading or restarting the web server.
Quick summary: installing your own SSL certificate in BitrixVM
1. Prepare the certificate, private key, and certificate chain if required.2. Make sure all files are in PEM format.
3. Verify that the certificate matches the private key.
4. Run /root/menu.sh.
5. Open 9 → 2 → 2. Configure own certificate.
6. Specify the website and full paths to the certificate files.
7. Confirm the installation.
8. Check the configuration with nginx -t.
9. Open the website over HTTPS and verify the certificate.
10. Enable forced HTTPS if required.
For a standard BitrixVM installation, it is preferable to install your own SSL certificate using the built-in menu. Manual Nginx configuration should be reserved for non-standard cases.