Sign in Get started
Documentation menu
Getting started Installation Updates and release channels Command line Panel settings License Uninstalling
Site management Adding a site PHP version and settings SSL certificates File Manager Databases and phpMyAdmin FTP accounts Subdomains Cron jobs Site Hub
Operations Backup and restore DNS management Valkey cache App installer Containers Services and processes Health Check Alerts Logs Virus Scan Network & Access Cloudflare management
Users and security Users Permission groups and packages My Account and account security Site migration
Site management

SSL certificates

Certificates come from Let's Encrypt and are renewed automatically before they expire.

How it works

The panel gets and renews certificates from Let's Encrypt. It picks the validation method itself, based on the state of the domain:

  • HTTP validation — used when the domain's A record points to this server.
  • DNS validation — used when the domain's name servers point to this panel's PowerDNS, or when Cloudflare is connected. It works even if the domain does not point to this server yet, and it is the only way to get a wildcard certificate.

If the domain is in neither state, the panel reports an error without contacting Let's Encrypt. The certificate and private key stay on your server.

Getting a certificate

If Automatic SSL is on when you create the site, you do not need to do anything else. To get one later, use the Get SSL button on the site's row. Once the certificate is issued, the site switches to HTTPS and the site card shows SSL Active.

You can also get a certificate for the panel's own address: Settings → Panel Access → Panel SSL certificate. This step uses DNS validation, so it needs a Cloudflare connection. For the address Let's Encrypt sends expiry warnings to, you can fill in the optional notification email in the same section.

Renewal

The panel renews certificates that are close to expiring on its own schedule; no manual action is needed. An administrator who wants to renew them all right away can use Sites → Renew SSL (all), which starts renewal for every certificate that is close to expiring.

You can also check a certificate's validity dates from the server:

bash
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null \
  | openssl x509 -noout -dates

Wildcard certificates

Wildcard certificates in the form *.example.com can only be issued with DNS validation. If DNS validation is available for the domain (name servers pointing to PowerDNS, or a Cloudflare connection), the panel gets the wildcard certificate itself.

The Add Wildcard Support button on a site does not change the certificate. It routes requests for *.example.com to this site and writes the *.example.com A record. If you remove it, those requests land on the "no matching site" page.

When issuing fails

  • "Waiting on DNS" — the domain does not point to this server yet. Check the A record; the panel retries every hour for 48 hours. After that, automatic retries stop and you start the certificate manually with Reissue. For errors other than DNS, retries run daily at growing intervals, up to 6 times.
  • CAA record — if the domain has a CAA record that does not allow Let's Encrypt, validation is rejected.
  • Ports 80 and 443 closed — HTTP validation needs access to port 80. Check the firewall and your hosting provider's network rules.
  • Cloudflare is in "Full (strict)" mode but the server has no certificate — Cloudflare tries to connect to the server over HTTPS; if there is no certificate, the site does not open. Get the certificate first.
  • Attempt limit — Let's Encrypt limits a large number of failed attempts in a short time. After several failed attempts in a row, you need to wait for a while.

The reason an attempt failed is shown in the error message in the panel.