Issue a Let's Encrypt certificate for a website

Before you start#

StackRegent issues Let's Encrypt certificates with the HTTP-01 challenge: Let's Encrypt fetches a token from http://<name>/.well-known/acme-challenge/ on port 80. So, for every name you want on the certificate:

• the name's A record (and AAAA record, if it has one) must point at this server,
• port 80 must be open from the internet, in Windows Firewall and in any provider firewall,
• SSL/TLS support must be on in the website's Hosting Settings.

Names that do not resolve to the server are left out of the certificate, and the task log says which. Wildcard certificates are not available yet. These steps work for administrators, resellers and customers; customers see the same tool in their own panel.

Step 1: Open the website#

Go to Hosting Services › Subscriptions, open the subscription and click Manage next to the website. Customers open Websites & Domains and the website.

Step 2: Open SSL/TLS Certificates#

In the Website tools, click SSL/TLS Certificates.

Step 3: Choose the names#

On the Let's Encrypt card, tick the names to include, typically example.com and www.example.com. If mail for the domain is hosted here, you can include mail.example.com too; the panel answers its validation even though no website uses that name.

Step 4: Get the certificate#

Click Get a free certificate. Issuing runs as a task and takes up to a minute. When it finishes, Certificate in use shows the new certificate under Secure the website with.

Step 5: Redirect HTTP to HTTPS#

Open Hosting Settings and tick Permanent SEO-safe 301 redirect from HTTP to HTTPS under Security, then Save. The redirect leaves /.well-known/acme-challenge/ alone, so renewals keep working. Turn on HSTS under IIS Settings only once HTTPS works for every name of the site.

Step 6: Check the result#

Open https://www.example.com/ in a browser and look at the certificate, or run curl.exe -sI https://www.example.com/ on a server with curl. On Windows Server 2022 and 2025 the site negotiates TLS 1.3; on 2016 and 2019 it uses TLS 1.2.

Renewal and automatic certificates#

Let's Encrypt certificates are valid for 90 days, and StackRegent renews them 30 days before they expire. If a renewal fails, the SSL/TLS certificate renewal failed notification goes to the recipients set under Tools & Settings › Notifications, and the SSL/TLS certificates widget on Home lists certificates that expire within 30 days.

To stop doing this by hand, tick Keep websites secured with free SSL/TLS certificates on the Additional Services tab of the service plan. Every domain of the plan's subscriptions then gets a certificate by itself once its DNS points at the server.

The panel's own certificate#

The panel on port 9443 has its own certificate, set under Tools & Settings › SSL/TLS Certificates: enter the Panel host name, click Save, then Secure the panel with Let's Encrypt. On the same page, Certificates of mail and FTP decides which certificate SMTP, IMAP, POP3 and FTPS present. For tests, the Let's Encrypt section can switch to the staging CA, which has higher limits but issues certificates browsers do not trust.

If issuing fails, see Let's Encrypt fails.