The panel can both issue free certificates itself and install a certificate you have purchased. Start by deciding which you need — see What is an SSL certificate and why does my website need one? if you are unsure.
A free certificate (recommended for most sites)
1. Check the panel settings
This step is only needed once, and requires administrator access. Go to Settings → Configuration → Security → SSL/TLS certificates.
- In the Let's Encrypt block, set Environment to Production, and fill in Country and State / Province / Region.
- In the SSL/TLS certificate notifications block, set the certificate owners and the expiry warning period.
If the environment is left on the test setting, certificates are still issued but browsers will not trust them. The test environment is only for checking that the panel is working.
2. Issue the certificate for a domain
- Go to Domains, find the domain and open it for editing.
- On the Security tab, under SSL/TLS certificate, select Let's Encrypt certificate.
- Save, and wait until the domain shows the status Everything is fine.
The certificate is renewed automatically thereafter. For the domain validation to succeed, the domain must already point to this server (A record) and be reachable over HTTP.
Installing a purchased certificate
1. Create a certificate request
Go to Security → SSL/TLS certificates and click Add SSL/TLS certificate. Fill in the form, select the owner and tick Create CSR.
The request is then generated — copy it. The certificate also appears in the list below with the name you gave it.
The matching private key stays on the server and is never sent anywhere, which is why the request has to be generated here rather than elsewhere.
2. Submit the request
In your client area, open the certificate among your services, start the SSL configuration wizard and paste in the CSR you copied.
3. Pass the domain verification
- By email — a message is sent to an administrative address of the domain; confirm by following the link in it.
- By HTTP — create the directories /.well-known/pki-validation in the root of your site, place there a text file with the specified name and contents, then follow the verification link.
Once verification succeeds, the issued certificate appears in your client area.
4. Install the certificate
Copy the contents of the CRT and CA fields from your client area. In the panel, find the certificate in the list, click Edit, and paste the values into the corresponding fields.
5. Assign it to the domain
Go to Domains, open the domain for editing and switch to the Security tab. Under SSL/TLS certificate choose Select certificate and pick yours from the list. Tick Force secure connection if you want visitors redirected from HTTP to HTTPS, then save.
Check the result
Open your site over https:// and confirm it loads without warnings. For a thorough check use SSL Labs, paying particular attention to the completeness of the certificate chain — that is what usually goes wrong when the CA field is filled in incorrectly or left empty.
If a certificate will not issue or has to be replaced
First check the obvious: the domain must resolve to this server and be reachable over HTTP, otherwise Let's Encrypt cannot confirm that you control it.
If a certificate is stuck and has to be reissued from scratch, the sequence is:
- Find where the certificate files for the domain are kept — the paths are in
/etc/apache2/keyhelp/vhosts/domain.conf— and copy them somewhere safe first. - In the panel, set the domain's certificate to No certificate and wait for the status Everything is fine.
- Delete the old certificate files and reload the web server:
systemctl reload apache2 - Set the certificate back to Let's Encrypt certificate and wait for the status again.
If it still does not work, open a ticket from your client area with the domain name.
