SSL Certificates

URL: /client/ssl-certificates

Overview

The SSL Certificates section displays all SSL certificates for your domains and enables certificate management, reissuance, and status control across your entire hosting account.

Internationalised domains

Domains with non-ASCII names are listed in their readable Unicode form, and the search box accepts either that form or the Punycode one. Certificates themselves are issued for the Punycode name, because that is what a browser sends and what a certificate authority signs. See Internationalised domain names.

Interface Elements

Tabs

Filter certificates by type:

• All domains - View all SSL certificates
• Free SSL - Let's Encrypt or ZeroSSL free certificates
• Private SSL - Paid/commercial SSL certificates
• Self-Signed - Internally generated certificates
• Disabled SSL - Domains with SSL disabled

Table Columns

Column	Description
Domain	Domain name (sortable)
Type	Certificate type (sortable)
Expiration	Certificate expiration date
Auto-renew	Automatic renewal status
Actions	View, Reissue, or Disable SSL

Controls

• Search bar - Locate specific domains
• Per page selector - Display 5, 10, 25, 50, or all entries
• Pagination - Navigate through certificate listings

Actions

For domains that are already secured:

• View - Display certificate details and properties
• Show private key and Download private key - Since panel 1.9.4, the only way to read the certificate's private key. See The private key.
• Reissue - Generate a new certificate for the domain
• Replace with a free certificate - Since panel 1.9.3, on a certificate that is not from Let's Encrypt or ZeroSSL. See Certificates that are not renewed automatically.
• Disable SSL - Turn off SSL for the selected domain

For domains that are not yet secured:

• Enable Free SSL - Issue a free certificate for the domain
• Upload certificate - Provide your own certificate for the domain

View Certificate

The View action opens a modal with the following certificate details:

• Issuer - The certificate authority that issued the certificate
• Valid To - The expiration date of the certificate
• Certificate (textarea) - The full PEM-encoded certificate content
• Private Key - Since panel 1.9.4 the key is not shown here: "The private key is not shown here. Use Show private key or Download private key on this domain."
• Certificate Chain (textarea) - The intermediate and root certificates in PEM format

The private key

Since panel 1.9.4, a certificate's private key is shown only when you ask for it:

• Show private key opens Private key for domain with the key in a read-only field. The dialog says "Showing or downloading the private key is recorded in the activity log."
• Download private key saves the key as a .key file named after the domain.

Each request is recorded in the activity log, which your hosting provider can see, with the domain and whether the key was shown. When the server does not return the key, the message The private key could not be read gives a reference to quote to support. After many requests in a short time, Too many private key requests says how many minutes to wait.

The client API offers the same: GET /api/client/ssl-certificates/{domain_id}/private-key returns the key and is recorded the same way. Since 1.9.4, GET /api/client/ssl-certificates/{domain_id} no longer includes the private key.

Pending certificates

Since panel 1.9.4, a domain that AutoSSL has not secured yet reads Certificate pending in the Type column instead of SSL Disabled, and on the Domains page and the dashboard instead of Not secured. Hover over it for the reason, one of these, and when the panel tries again:

• "The domain does not exist in public DNS yet. Point it at this server."
• "The domain has no public A or AAAA record yet. Point it at this server."
• "The domain points only at private IP addresses. Point it at this server's public IP address."
• "The domain is not a public name that certificate authorities accept."
• "The last automatic attempt did not get a certificate."
• "The certificate was issued, but the web server could not be switched to HTTPS yet."
• "The panel is requesting a certificate for this domain."

The line after the reason reads "The panel tries again automatically, usually within the hour." A domain is pending only while AutoSSL is on for the account and the domain has no certificate in use. A parked domain counts as secured by the certificate of the domain it is parked on. In the client API, ssl_pending on the certificates and domains endpoints carries the same reason and next attempt.

Enabling Free SSL

A domain that is not yet secured appears under the Disabled SSL tab with an Enable Free SSL action. This requests a free certificate (Let's Encrypt or ZeroSSL, depending on the provider your host has configured).

For issuance to succeed:

• The domain must already resolve to this server (its DNS A record must point here), so the certificate authority can validate ownership over HTTP.
• Validation runs automatically; issuance usually completes within a few minutes.
• The domain's web server configuration is refreshed before validation starts, so a site whose configuration predates a panel upgrade is validated against the current one. A refresh that fails is recorded in the execution logs and issuance still goes ahead, so check those logs first when validation fails for no visible reason.

Since panel 1.9.0, when an extra name on the certificate points to an IPv6 address this server cannot reach, issuance still completes: that name is left off, with the reason, and the certificate covers the rest.

Once issued, the certificate moves to the Free SSL tab with Auto-renew enabled, so it renews before expiry without any further action. Use Reissue to request a fresh certificate at any time, or Disable SSL to remove it.

If you have your own commercial certificate, use Upload certificate instead to provide the certificate, private key, and chain.

Since panel 1.9.1, an uploaded certificate is stored with automatic renewal off. It is not renewed or replaced with a free certificate, so renewing it with the authority that issued it, before it expires, is up to you.

Certificates that are not renewed automatically

Free certificates from Let's Encrypt or ZeroSSL are renewed automatically. A certificate from another issuer, such as one you uploaded or one brought over from another server, is not: the panel never replaces it on its own. A free certificate is not renewed either while AutoSSL is switched off for your account.

Expiry reminders

Since panel 1.9.3, the notification bell of the client panel reminds you of such a certificate 30, 14, 7, and 1 days before it expires, and once it has expired. The reminder names the domain and the date. For a certificate from another issuer it has a Replace with a free certificate button. For a free certificate it explains that AutoSSL does not renew it, and asks you to issue a new certificate before it expires or ask your hosting provider to switch AutoSSL on.

While a certificate from another issuer expires within 30 days or has expired, the SSL Certificates page also shows SSL certificates that need your attention above the list, with each domain, its expiry date, and a Replace with a free certificate button.

Replacing a certificate with a free one

Replace with a free certificate swaps a certificate from another issuer for a free one from the certificate authority your hosting provider has set up:

1. Click Replace with a free certificate on the certificate's row or in the banner.
2. Read the confirmation. When AutoSSL is switched off for your account, it warns that the free certificate will not be renewed automatically either.
3. Click Replace certificate.

The current certificate stays in place until the free one has been issued. If it cannot be issued, the notification gives the reason and the current certificate keeps working. As with Enable Free SSL, the domain must resolve to this server.

To replace several certificates at once, select them and choose Replace with free certificates. They are replaced one after another in the background, and the notification bell gives the result when they are done.

The client API offers the same: POST /api/client/ssl-certificates/{domain_id}/replace-free for one domain, and POST /api/client/ssl-certificates/replace-free-bulk with a list of domain_ids for several. See the API reference.