KoaPanel
IT Try it free
All manual sections

DocumentationHTTPS

HTTPS

HTTPS protects the data visitors exchange with your site and shows the padlock in the browser. The panel uses free Let's Encrypt certificates.

Turning on HTTPS

Before starting, check that:

  • the domain (and any aliases) already points to this server;
  • port 80 of the server is reachable from the Internet (it is, unless you closed it in the firewall).

Then open the site, Overview tab, SSL / HTTPS box, and press Get a free certificate. You can enter an email Let's Encrypt will write to in case of problems.

The request usually takes less than a minute and continues in the background. When it is done the site answers in HTTPS and whoever opens the HTTP address is taken automatically to the secure version.

Renewal

Certificates last 90 days and renew by themselves about a month before they expire: there is nothing to do.

If the renewal fails (for example because the domain no longer points to the server), the panel emails the administrators when fewer than 14 days are left, wildcard certificates included. See System emails.

To renew right away, press Renew now in the SSL / HTTPS box: the panel asks Let's Encrypt for a new certificate and reloads the site. Use it after fixing what blocked the automatic renewal. To stay within Let's Encrypt's limits, a certificate issued less than 24 hours ago is not renewed again.

If the request fails

The most common cause is DNS: the domain does not point to the server yet, or the change has not propagated yet (it can take a few hours). Check the DNS and try again. The error details appear under the button (administrators also find them in Jobs).

Turning off HTTPS

In the SSL / HTTPS box press Turn off HTTPS: the site goes back to HTTP and the certificate is deleted.

Wildcard certificate

The Wildcard certificate card asks Let's Encrypt for a single certificate for the domain and all its subdomains (*.example.com), handy when there are many subdomains or they change often.

  • A wildcard certificate can only be obtained with the DNS challenge: the panel writes a TXT record _acme-challenge in the domain's zone by itself and removes it right after. So the domain's DNS must be managed by the panel: on this server's DNS or with a Cloudflare or 1PrimeCDN connection on the DNS page. The domain doesn't have to point to the server yet.
  • With The site also answers on every subdomain any subdomain (for example shop.example.com) opens this site, unless it's a site of its own in the panel. Remember to add a * record pointing to the server in the DNS.
  • The regular certificate, if there was one, is replaced. The panel renews the wildcard certificate by itself, 30 days before it expires, with the same DNS connection; Renew now does it right away.
  • Turn off HTTPS in the SSL / HTTPS card also removes the wildcard certificate; requesting the regular certificate replaces it.
  • When you move the account to another server the wildcard certificate isn't copied: request it again on the new server (or request the regular certificate).

Certificate uploaded by hand

If you bought a certificate elsewhere (for example OV or EV, or issued by your company's authority), use the Certificate uploaded by hand card on the site page: press Upload a certificate and paste, in PEM format, the certificate, the private key and, if you got it separately, the chain of intermediate certificates. Then press Install the certificate.

  • The panel checks that the private key matches the certificate, that the certificate is for the site's domain and that it is valid today. The key must have no password: if it is protected, remove it with openssl pkey -in key.pem -out key-no-password.pem.
  • It doesn't block, but warns, when the certificate doesn't cover some alias of the site, when the chain doesn't lead to a trusted authority (usually the intermediate certificate is missing) or when it expires within 30 days.
  • The site's Let's Encrypt certificate, if any, is removed. The SSL / HTTPS card shows who issued the certificate and when it expires.
  • The panel doesn't renew a certificate uploaded by hand: 14 and 3 days before it expires it reminds you to upload the new one (with Upload the new one, in the same card). To go back to Let's Encrypt turn HTTPS off and on again, or request the wildcard certificate.
  • The site's backups hold the certificate and put it back on restore. When you move the account to another server, upload it again on the new server.

Dedicated IP

Administrators can give a site an IP address of its own (Dedicated IP card on the site page): nginx serves the site on that address and whoever opens the address only finds that site, even without a name. The address must already be configured on the server (an additional IP from the provider); the server's main address stays shared and can't be dedicated, and an address goes to one site only.

If the panel manages the site's DNS zone, the A/AAAA records are updated to the new address; otherwise update them at your DNS provider. The HTTPS certificate doesn't change. If one day the address is removed from the server, the site goes back to the shared address at the next change, instead of blocking the web server. When you move the account to another server the site starts with the shared address.