Koapanel
IT Try it free
All manual sections

DocumentationPanel certificate

Panel certificate

The panel, phpMyAdmin and webmail open over HTTPS. From version 0.30.0 the panel asks Let's Encrypt by itself for a valid certificate also when you open it by its IP address (for example https://203.0.113.10:8443): the browser no longer shows "Not secure". The status is in Server › Security, Panel certificate box.

Certificate for the IP address

  • It is requested at installation and at every update, then renewed automatically once half of its life has passed (about 3 days, with a few hours of offset that differ for each server, leaving 3 days of retries before it expires). If Let's Encrypt asks for an early renewal (for example after a revocation), the panel renews earlier. The box shows the expiry, the last and the next renewal. It is a Let's Encrypt certificate of the "shortlived" profile, valid about 6 days: the only kind Let's Encrypt issues for IP addresses.
  • It covers the server's public IPv4 and, when reachable, its IPv6. If the IPv6 does not answer Let's Encrypt, the certificate covers IPv4 only and IPv6 is retried after 24 hours.
  • The check happens on port 80 (it must be open to the Internet, as for the sites). If port 80 is closed by the provider's firewall and 443 is free (no site has a certificate yet, as right after the installation), the panel validates on port 443 (tls-alpn-01).
  • If the server only has private addresses (it is behind NAT), the IP certificate is not requested and the box explains why: if the router forwards ports 80 and 443 to the server, enter the public address in DNS › Public address of the server. With cloud provider NAT (AWS, Google Cloud: the public address is not on the machine) the certificate works if port 80 reaches the server.
  • The certificate is used at once by the panel (port 8443), phpMyAdmin (8444) and webmail (8445), without dropping open connections.
  • If the issuance fails, the installation's self-signed certificate stays: the panel is always reachable. The box shows the error and when the next attempt happens (after 30 minutes, then at growing intervals up to a day, within Let's Encrypt's limits).
  • Renew now asks for a new certificate at once (at most one every 10 minutes).

Panel name

You can give the panel a name of yours, for example panel.mydomain.com:

  1. in the domain's DNS create an A record (and AAAA if the server has IPv6) pointing to the server's address. If the domain is managed by this server's DNS, the panel offers to create the record with one click;
  2. type the name in Panel name and save: the panel checks that the name points to the server and asks Let's Encrypt for a normal certificate for it (90 days, renewed automatically);
  3. from then on the panel, phpMyAdmin and webmail also answer on that name with its certificate, and the panel's emails use that name in their links (unless you set another address in System emails).

With Opening the panel by IP address goes to the name, whoever opens the panel by IP is taken to the name. API calls by IP (billing systems, linked servers) keep working.

The name cannot be the one of a site of the panel: use a dedicated subdomain.

Linked servers

A server linked with the fingerprint of its self-signed certificate keeps working when it switches to a Let's Encrypt certificate: the panel accepts the new certificate because it is valid for the server's address.