Get a free SSL certificate for your website
This page gets a free certificate issued and renewing on its own, installs one you already hold, and reads every refusal the panel can give you when a paste is wrong. A domain added later joins the certificate within the hour, so there is nothing to come back and reissue.
Before you start
The domain has to resolve here.
A certificate is issued by proving you control the name, and that proof is made over the domain itself. So the name has to point at this server before anything can be issued. Check it from somewhere other than the server:
dig +short example.com dig +short www.example.com
Both should answer with your server’s address. If issuing fails, this is almost always why: the name does not resolve here yet, or it resolves somewhere else. See DNS and nameservers.
Step 1
Request it, and forget it.
Open the website, find HTTPS for your website, and press Request a Let’s Encrypt certificate. It covers the names that resolve to this server and renews itself before it runs out. Installed certificate then shows what is actually in place: which names it covers and when it expires.
- Add every name you want covered first, including
wwwif you use it. A name not on the website is not on the certificate. - A name added later joins within the hour, so there is nothing to reissue by hand.
- Request / renew is also how to force a renewal early, if a name changed and you would rather not wait.
Step 2, only if you have your own
Install a certificate you already hold.
Your own certificate takes a wildcard you bought, or one from an authority you run yourself. Two fields: the certificate and the private key, both PEM.
Paste your own certificate first, then the authority’s chain below it. The order matters and the panel checks it: a key that belongs to the second certificate rather than the first is refused with that exact complaint, because a chain in the wrong order is served wrong even when every piece of it is right.
-----BEGIN CERTIFICATE----- ... your certificate, the one for example.com ... -----END CERTIFICATE----- -----BEGIN CERTIFICATE----- ... the intermediate that signed it ... -----END CERTIFICATE-----
It is checked before it is installed rather than after, and the panel names any domain on the website that the certificate does not cover. That is the mistake a wildcard usually hides: *.example.com does not cover example.com itself.
The fields
What each one takes, and what it refuses.
| Field | What it takes | Limits and refusals |
|---|---|---|
| Certificate | PEM, your own certificate first and any chain after it. | Up to 256 KB and at most 10 certificates in the chain. It must name at least one of this website’s domains, must not have expired, and must not be post-dated. Anything else in the text, such as a key or a certificate request, is refused by name rather than ignored. |
| Private key | The PEM key for the first certificate. | Up to 256 KB. It must belong to the first certificate and be a type this server can use. A certificate pasted into this box is refused as a certificate rather than failing obscurely later. |
The website must have finished provisioning before a certificate can be installed. There is nothing to install it into until then.
When a paste is refused
Reading the message.
| What it says | What happened | What to do |
|---|---|---|
this private key does not belong to this certificate |
The two do not match. | Check you have the key for this certificate and not for the previous one. Reissuing usually produces a new key as well. |
the certificate this key belongs to is not the first one… |
The chain is in the wrong order: your certificate is below the authority’s. | Put yours first and the authority’s after it. |
this certificate expired on… or is not valid until… |
Outside its own dates. The second usually means the server’s clock is wrong. | Get a current certificate, or check the date on the server. |
this certificate does not name any of this website’s domains |
It is for something else. The message lists the names it is actually for. | Check you pasted the right certificate, or add the domain to the website first. |
the certificate contains a … block, which is not a certificate |
The key, or a certificate request, is in the certificate box. | Paste only certificates there. The key goes in its own field. |
that is not a PEM encoded certificate |
The format is DER or PKCS#12 rather than PEM. | Convert it: openssl x509 -in cert.der -inform DER -out cert.pem. |
this certificate names no host |
It has no subject alternative names, so nothing could be served with it. | Get one issued for the domain. |
Afterwards
What the panel will and will not touch.
Once you supply a certificate, nothing automatic replaces it. The panel records that this one was supplied and keeps its own renewal away from it, because silently overwriting an operator’s certificate with one it obtained would be the wrong answer every time. Remove certificate takes it off again and puts the website back to where it can be issued one.
The private key is stored so that only root can read it. It is never served, never shown back to you, and does not travel: moving a website to another server does not carry its key, which is why a moved site is issued a new certificate there rather than handed the old one.
What was installed is recorded in the activity trail by serial, issuer and names. The key is not, because what was installed is worth recording and what it was installed with is not.
Hosting mail for a domain also wants certificates on its mail. and smtp. names, so mail clients connect without a warning. Dashmox issues those alongside the website’s. See email DNS records.
Your servers, with nothing on them counted.
The whole panel is free on one server, with no limit on websites, mailboxes, DNS zones or customer accounts. Pro carries five servers and Business as many as you run.