SSL certificates

#SSL by installation type

The installation type decides who obtains certificates. The panel reads this from BIPANEL_SSL_MODE.

In edge mode the SSL/TLS page only shows status, and the panel does not issue certificates. The rest of this page covers server installations. For container installations, see Docker and Railway.

#Automatic certificates (AutoSSL)

AutoSSL is on by default for server installations, and certbot is installed along with the panel. When a domain is added to an account, the panel requests a certificate within seconds. The certificate covers the domain, its www name (when www is enabled for the domain) and any parked alias domains.

• The panel first checks whether the domain's A record points to this server. If it does not, the panel does not contact Let's Encrypt at all, so you stay clear of its rate limits.
• The AutoSSL task runs every 6 hours. It requests a certificate for domains that have no valid one, and for Let's Encrypt certificates with fewer than 10 days left. A domain that fails is left alone for 24 hours.
• certbot's own timer also handles renewals. After a renewal, Apache, Postfix and Dovecot are reloaded.
• If a domain is more than 24 hours old and still has no certificate, the account owner is notified, at most once every 3 days.
• If a Let's Encrypt certificate has 14 days left and has not been renewed, both the account owner and the administrator are warned.

Users manage certificates on Security → SSL/TLS with Issue certificate, Install certificate, Create self-signed and Remove certificate. Removing a certificate also turns off the domain's Force HTTPS setting. On Server Admin → Domains → SSL & AutoSSL, administrators turn AutoSSL on or off, set the Let's Encrypt contact email, run AutoSSL manually and see domains without a certificate. Resellers see only their own accounts there.

#Validation methods: HTTP-01 and DNS-01

HTTP-01 is the default. certbot serves the validation file through the web root, so the domain's DNS must point to this server. Domains behind the Cloudflare proxy (orange cloud) are still tried this way.

With DNS-01, certbot writes the _acme-challenge TXT record to the domain's DNS provider through the panel, then waits until the authoritative nameservers show it. DNS-01 is used when:

• DNS validation has been selected for the domain,
• a wildcard certificate is requested, or
• the name does not resolve to this server but a provider can manage the domain's DNS. This automatic fallback is on by default. If it fails, issuance continues with HTTP-01, and DNS is not retried for that certificate for 24 hours.

Users pick the method per domain on Security → Wildcard & DNS Validation: Automatic (HTTP, else DNS), HTTP only or DNS (TXT record).

#DNS providers

Connecting providers and managing zones is covered on the DNS page. DNS-01 relies on the ACME DNS validation system component (certbot, curl and the hook script), which is installed by default. Server Admin → Security → ACME & Certificate Authorities shows the component's status, the fallback setting and the maximum propagation wait (60–1800 seconds, default 300).

#Wildcard certificates

A wildcard certificate covers *.example.com together with example.com. Wildcards can only be issued with DNS-01, so one of the providers above must manage the domain's DNS; otherwise the panel rejects the request and says why. A certificate issued with Issue wildcard is also attached to the subdomains it covers. The domain's preference is saved as wildcard, so later renewals keep it.

#Certificate authorities and key type (Pro)

In the Community edition every ACME certificate comes from Let's Encrypt and uses certbot's default key type. In the Pro edition, administrators add other authorities on ACME & Certificate Authorities and choose the server default. Users can also pick an authority and key type for each domain.

The EAB HMAC key is stored encrypted. certbot receives it through a temporary file that only root can read, never on the command line. Key type options are certbot default, RSA 2048, RSA 4096, ECDSA P-256 and ECDSA P-384. If the license stops being valid, the settings are kept, but new certificates are issued by Let's Encrypt with the default key. See pricing for edition details.

#Purchased certificates and SSL storage

The SSL storage tab on the SSL/TLS page stores private keys, CSRs and certificates for each account. Private keys are encrypted in the database.

1. Use the Commercial certificate steps to create a private key and CSR. Key types are RSA 2048/3072/4096 and ECDSA P-256/P-384. www and parked domains are added to the CSR automatically, and a wildcard name is optional.
2. Paste the certificate from the authority and its CA bundle (intermediate certificates). You can also upload your own PEM key; RSA keys must be at least 2048 bits.
3. The panel downloads missing intermediates from the certificate's AIA address and verifies the chain against trusted roots. If openssl is installed, it also runs openssl verify. The result is Chain complete, Chain incomplete, Private CA, Self-signed or Chain invalid.
4. Install the certificate on one or more domains. If the Apache configuration test fails, the previous certificate is restored.

For certificates that do not renew automatically, the account owner and the administrator get reminders 30, 14 and 7 days before expiry and again when the certificate expires. The Expiry schedule tab shows all of them.

#Panel, mail and FTP certificates

• Panel (ports 2083 and 2087): On first start the panel creates a temporary self-signed certificate for the hostname. The Hostname certificate card on SSL & AutoSSL issues a Let's Encrypt certificate, and the panel switches to it without a restart. Administrators can also install a purchased certificate on the hostname from the Server SSL storage tab; other users cannot.
• Mail: Postfix and Dovecot use the installation's self-signed certificate by default. With SNI on (the default on server installations), each domain's own valid certificate is served for that domain on IMAP, POP3, ManageSieve and SMTP connections. mail.example.com is only served if the certificate covers it, for example with a wildcard. See Email for details.
• FTP: On the FTP Server page the default source is the hostname certificate. Each renewal of the hostname certificate is also written to FTPS. Without one, a self-signed certificate is used.

#Common problems

For other problems, see troubleshooting.