How to issue an SSL certificate

Quick answer: All major panels issue free Let's Encrypt certificates in one or two clicks once the domain resolves to your server: CloudPanel site → SSL/TLS → New Let's Encrypt Certificate, cPanel SSL/TLS Status / AutoSSL, HestiaCP domain → Enable SSL + Let's Encrypt, CyberPanel Manage SSL → Issue SSL, aaPanel site → SSL → Let's Encrypt. Renewal is automatic.

Overview

HTTPS is mandatory for modern sites (browsers, SEO, and user trust). Let's Encrypt certificates are free, valid for 90 days and renewed automatically by the panel. The single most important prerequisite: the domain must already resolve to this server, because Let's Encrypt validates over HTTP/DNS before issuing.

Before you start

• The domain added in the panel and its A record pointing at your server (guide).
• Port 80 open — the default HTTP-01 validation needs it.
• No conflicting redirect that blocks /.well-known/acme-challenge/.

Step-by-step guide

1. Verify DNS: dig +short yourdomain.com must return your server IP.
2. Issue the certificate in your panel (menu paths in the Quick answer). Include both the bare domain and www if you serve both.
3. Enable Force HTTPS/redirect in the panel (or the app) so HTTP traffic moves to HTTPS.
4. Confirm the padlock in a browser and re-test after a few minutes.
5. Leave auto-renewal on — panels renew via cron well before the 90-day expiry.

Common issues

• Issuance fails immediately: DNS does not point here yet, or propagation is unfinished — wait and retry.
• Validation error on /.well-known/: a redirect or app route intercepts the challenge path — disable it during issuance.
• Rate limits: too many failed attempts for the same hostname — fix the cause before retrying (limits reset within hours to days).
• Mixed content after enabling HTTPS: update hard-coded http:// asset URLs in the app.

When to contact support

If DNS is correct, port 80 is open and issuance still fails from the panel, open a support ticket with the domain and the exact panel error text.

Frequently asked questions

How much does an SSL certificate cost?

Nothing for most sites: every major panel integrates Let's Encrypt, which issues trusted certificates for free and renews them automatically every 60–90 days.

Why did Let's Encrypt issuance fail?

The domain does not resolve to this server yet, port 80 is closed, or a redirect blocks the /.well-known/acme-challenge/ path. Fix DNS and port 80 first, then retry.

Do I need to renew the certificate manually?

No. Panels renew Let's Encrypt certificates by cron well before expiry. If a site suddenly shows an expired certificate, check that the domain still resolves to the server.

Related articles

• How to add a domain in a control panel
• How to create a website in a control panel
• Control panel security checklist

Need a hand? Contact Cloud2Y support →