How to Install an SSL Certificate on IBM Cloud

This guide provides step by step instructions on how to install an SSL certificate on IBM Cloud. It covers the Certificate Signing Request CSR generation process and the installation itself. A bonus section includes tips on where to buy the best SSL certificate for your project.

If you’ve already generated the CSR and received your SSL certificate from the Certificate Authority, skip the first step and jump straight to the installation instructions.

Table of Contents

1. Generate CSR for IBM Cloud
2. Install an SSL Certificate on IBM cloud VPC
3. Install an SSL Certificate on IBM Cloud (Classic Infrastructure)
4. Where to buy the best SSL certificate for the IBM cloud?

Generate CSR for IBM Cloud

The CSR is a block of encoded text with your contact information. To obtain an SSL Certificate, you must create your CSR code and then send it to your CA for validation. Along with the CSR, you will also generate your private key, a crucial element of your SSL Certificate. You will need the private key during the installation process.

The quickest and easiest way to generate a CSR code is with a CSR generator tool. You don’t need any technical skills. All you have to do is enter the information, and the CSR generator will automatically create your CSR and private key.

Alternatively, you can generate the CSR by using software on the server. For UNIX systems use the OpenSSL utility. If you’re on Windows, you can access a wizard from the Directory Security tab of the website properties in IIS manager.

Whatever method you choose, keep your private keep in a safe location, and don’t share it with anyone. Do not lose or delete it.

Note: Some CSR generation utilities also give you the ability to create a passphrase for the private key. Do not do this unless you plan to log on to the server any time the web server software is restarted and do not apply a challenge phrase to the CSR.

Install an SSL certificate on IBM Cloud VPC

IBM Cloud supports two different infrastructure types: VPC (Virtual Private Cloud) and Classic. Each has its own way of handling SSL certificates. This guide shows you both, but we recommend using VPC + Secrets Manager, which is the current best practice for secure and scalable deployments.

This is the standard method for App Load Balancers, Kubernetes Ingress via ALB, and modern server setups.

Step 1: Import Your Certificate into Secrets Manager

After your CA sends you the certificate files (ZIP archive), extract them. You’ll need:

• Your server certificate (yourdomain.crt)
• Any intermediate certificates (intermediate.crt or .ca-bundle)
• Your private key (yourdomain.key, unencrypted, PEM format)

Then do the following:

1. Go to IBM Cloud Console > Resource list
2. Select your Secrets Manager instance
3. Click Add > Import a certificate anc Upload the following files:
   • Certificate (required)
   • Intermediate chain (optional but recommended)
   • Private key (required, must be unencrypted)
4. Click Add to save it

Step 2: Attach the Certificate to an Application Load Balancer (ALB)

Before the ALB can use the cert, you need to authorize access:

Create the Service Authorization

1. Go to IAM > Authorizations in your IBM Cloud Console.
2. Click Create and fill in the following:
   • Source service: VPC Infrastructure Services
   • Resource type: Load Balancer for VPC
   • Target service: Secrets Manager
   • Role: Writer
3. Click Create to save it.

Assign the Certificate to the Load Balancer

1. Open your Application Load Balancer from the IBM Cloud dashboard.
2. Create a new HTTPS listener or edit an existing one.
3. When prompted for the SSL certificate, either select the cert from Secrets Manager, or Paste the CRN (Cloud Resource Name) of the cert manually.
4. Click Save to apply the settings.

Note: If you update the cert in Secrets Manager, it won’t auto-refresh on the ALB. You need to nudge the listener (e.g., change the health check interval or pool config) to force it to reload the cert.

Install an SSL Certificate on IBM Cloud (Classic Infrastructure)

Use this guide only if you’re working with Classic Load Balancers or other Classic infrastructure services. This method does not apply to VPC or Application Load Balancer setups.

Install via IBM Cloud Console (Classic)

1. Go to your IBM Cloud Console
2. Navigate to Security > SSL > Certificates
3. Click Import a Certificate and upload all required files:
   • Certificate (yourdomain.crt)
   • Intermediate Certificate (intermediate.crt)
   • Private Key (yourdomain.key)
4. Click Add

Done. The certificate is now available to assign to Classic load balancer endpoints.

Install via IBM Cloud CLI (Classic)

Run the following command in your terminal:

ibmcloud sl security cert-add --crt server.crt --key server.key --icc intermediate.crt

This uploads the certificate, private key, and intermediate chain.

To confirm upload use:

ibmcloud sl security cert-list

That’s it. Certificate is installed and ready for assignment inside Classic infrastructure.

Assign the SSL Certificate to Classic Load Balancer (IBM Cloud Classic)

Follow these steps to connect it to a Classic Load Balancer:

Step 1: Go to Your Classic Infrastructure

• Open your IBM Cloud Dashboard
• In the left-hand menu, click Classic Infrastructure

Step 2: Locate Your Load Balancer

• Navigate to Network > Load Balancers
• Select either Local or Global, depending on your setup
• Find and click on the Load Balancer you want to configure

Step 3: Open Listener or SSL Settings

• Inside the Load Balancer details, go to the Listeners tab
• If there’s no HTTPS listener, add one now

Step 4: Assign Your Certificate

• In the SSL settings for the HTTPS listener, choose your uploaded certificate from the dropdown
• Save your changes

That’s it! Your Classic Load Balancer now uses the SSL certificate to serve traffic securely.

Where to buy the best SSL certificate for IBM cloud?

If you’re searching for affordable SSL Certificates, then SSL Dragon is the right place. Our fast and user-friendly website will walk you through the entire range of SSL Certificates. All our products are signed by trusted Certificate Authorities and are compatible with IBM Cloud services.

We bring you the best prices on the market and stellar customer support for any certificate you buy. And, if you’re struggling to find the perfect cert for your project, our SSL Wizard and Advanced Certificate Filter tools will give you quick suggestions.

If you find any inaccuracies, or you have details to add to these SSL installation instructions, please feel free to send us your feedback at [email protected]. Your input would be greatly appreciated! Thank you.