ISPmanager 6 has built-in integration with Let's Encrypt. The certificate is issued for free and renews automatically 30 days before expiration.
Get an SSL Certificate From Let's Encrypt
WWW → Domains → select the domain → Protection → Let's Encrypt → Get.
Parameters:
- Domain: example.com
- Include www: ✅ (if you need a certificate for www.example.com)
- Auto-renewal: ✅ (recommended)
How domain validation works
Let's Encrypt checks that you actually control the domain before issuing a certificate. ISPmanager uses the HTTP-01 challenge: the panel places a temporary file in the site directory, and the Let's Encrypt server requests it at http://example.com/.well-known/acme-challenge/. If the request succeeds and the file contents match, the domain is confirmed.
Install a Commercial Certificate
WWW → Domains → select the domain → Protection → SSL certificate → Upload.
Fields to fill in:
1. Private key (*.key)
2. Certificate (*.crt)
3. Certificate chain / CA bundle (*.ca-bundle or chain.crt)Setting Up an HTTP → HTTPS Redirect
WWW → Domains → select the domain → Edit → tick the «Redirect HTTP to HTTPS» box. ISPmanager will add the required redirect to the Nginx/Apache config automatically.
Common certificate issuance errors explained
| Message | What it means and how to fix it |
|---|---|
DNS problem: NXDOMAIN looking up A record | The domain has no A record pointing to the server's IP — Let's Encrypt can't find the server to validate |
Connection refused / Fetching http://…: Connection timed out | Port 80 is blocked by the firewall or taken by another service — the challenge file is unreachable from outside |
too many certificates already issued for this exact set of domains | The Let's Encrypt rate limit is exceeded — 5 identical certificates per domain per 7 days |
Invalid response from …: 404 | The challenge file was created, but the web server returns 404 at that path — often caused by a redirect rule catching the /.well-known/ path |
Checking the Certificate
openssl s_client -connect example.com:443 -servername example.com | openssl x509 -noout -dates
# notBefore: start date
# notAfter: expiration dateAuto-renewal: what happens on the server
Let's Encrypt auto-renewal in ISPmanager is handled by a scheduler job that periodically checks each certificate's expiration date and reissues it once fewer than 30 days remain. If the job is disabled or broken (for example, after a manual crontab edit), certificates will quietly age toward expiration — the panel doesn't always surface this as an active error until the last moment.
List of Certificates
WWW → SSL certificates — a list of all issued certificates with their expiration dates and auto-renewal status.
Let's Encrypt vs. commercial certificates
| Criterion | Let's Encrypt | Commercial (OV/EV) |
|---|---|---|
| Cost | Free | From several tens of $ per year |
| Validity period | 90 days, auto-renewal | 1-2 years |
| Organization verification | None (domain only, DV) | Yes (OV/EV require documents) |
| Wildcard certificate | Yes, via DNS-01 | Yes |
| Trust level for payment systems | Sufficient for most | Sometimes required explicitly (banks, acquiring) |
When Let's Encrypt is not the right fit
- You need legally verified organization validation (OV/EV) — for example, for a payment gateway that explicitly requires an EV certificate
- You need a multi-year certificate without renewal automation — more convenient on isolated systems without access to an ACME client
- The domain doesn't resolve publicly (internal DNS, VPN-only service) — Let's Encrypt's HTTP-01 validation requires the domain to be reachable from the internet
- Regulatory requirements name a specific certificate authority or certificate format explicitly — for example, for government information systems in some jurisdictions
Verifying the result
After issuing or renewing a certificate, confirm that the browser and external clients actually see the new certificate, not a cached old version.
# Check that the certificate applied to the intended domain
echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -subject -issuerIf the output shows an issuer other than "Let's Encrypt" — the old CA — the web server config still points to the previous certificate file, and you need to check the path in the Nginx/Apache config. See also creating a website in ISPmanager 6 and choosing between Nginx and Apache.
Frequently asked questions
What happens to the site if auto-renewal fails and the certificate expires unnoticed?
If the certificate expires, visitors' browsers show a warning about an untrusted connection and usually block access to the site without an explicit override from the user. Search engines and some external services may also stop reaching the site over HTTPS. It is worth periodically checking the certificate list in the panel instead of relying on automation alone.
Can you keep both a Let's Encrypt and a commercial certificate active for the same domain at the same time, say during a migration?
Technically both certificates can be stored in the system at once, but only one can be active for the domain at any moment — that is the one applied to the web server configuration. During a transition, people usually keep the old commercial certificate active, test the new Let's Encrypt one separately, then switch the domain in a single step.
Do you need to reissue the certificate when switching the web server from Apache to Nginx?
There is no direct dependency: the certificate itself is just a key file that works the same way with either web server. After switching from Apache to Nginx, or the other way around, the configuration the certificate is embedded in changes completely, so ISPmanager automatically reattaches the existing certificate to the new configuration without contacting Let's Encrypt again.
Do you need to manually reinstall the certificate after moving the site to a new IP address or new hosting?
No, if the domain and panel move together with the certificate, reinstalling it manually is not necessary — it keeps working until it expires regardless of the server's IP address. On the new server, though, you do need to set up auto-renewal again and confirm that port 80 is reachable from outside for the Let's Encrypt HTTP-01 check to pass.