FlashPanel

SSL ​

FlashPanel can issue free SSL certificates from Let's Encrypt, ZeroSSL and Cloudflare, and can install certificates you bought elsewhere. Open SSL in the site's menu to get started. The page has two parts: Install Certificate (the ways to install) and Certification List (the site's certificates).

Let's Encrypt ​

Let's Encrypt provides free SSL certificates recognized by all major browsers.

FlashPanel automatically renews Let's Encrypt certificates once they are 21 days or less from expiration. Renewal runs at a random time of day to avoid overloading the Let's Encrypt servers. You can also renew manually from the Certification List.

Steps to install a Let's Encrypt certificate:

  1. On the site's SSL page, select the Let's Encrypt (Free) card
  2. Check the domain list: each row shows the domain, the IP it currently points to and a green check mark if it points to the server. Domains must point to the server for the certificate to be issued
  3. (Optional) Check Automatically activate the certificate after installation
  4. Click Install Let's Encrypt

TIP

If the domain uses Cloudflare DNS with the proxy enabled (orange cloud), the domain check result may not be accurate.

WARNING

Due to the Let's Encrypt renewal process, Let's Encrypt certificates cannot be cloned to other sites. Issue a new Let's Encrypt certificate for that website instead.

ZeroSSL ​

ZeroSSL is a free SSL certificate provider recognized by all major browsers.

Follow the same steps as Let's Encrypt (select the ZeroSSL (Free) card). FlashPanel registers with ZeroSSL using the site owner's email, so you don't need to create a ZeroSSL account first. ZeroSSL certificates are renewed automatically just like Let's Encrypt.

SSL for IP addresses ​

FlashPanel can issue free SSL certificates for your server's IP addresses (both IPv4 and IPv6) via Let's Encrypt. This is useful when you need HTTPS access to your server or API before you have a domain. To use it, create a website whose domain is the server's IP address, then install a Let's Encrypt certificate as usual.

  • Renewal: IP certificates have a very short lifespan (about 6 days), so FlashPanel renews them automatically once they have 4 days (96 hours) or less left.
  • Requirements: Port 80 must be open for Let's Encrypt validation.

Cloudflare ​

If your domain uses Cloudflare DNS, FlashPanel can automatically create and install a 15-year Cloudflare Origin certificate, with no periodic renewal like Let's Encrypt or ZeroSSL.

Requirements:

  • You have added your Cloudflare credentials to FlashPanel and the domain belongs to that Cloudflare account. See Connect DNS Provider. The API key needs the SSL and Certificate permission.
  • The certificate only supports the root domain or first-level subdomains (for example domain.com, app.domain.com).

Steps to install:

  1. On the site's SSL page, select the Cloudflare card
  2. Click Install Cloudflare

TIP

Cloudflare Origin certificates are only trusted by browsers when traffic goes through the Cloudflare proxy. In Cloudflare, enable the proxy for the DNS record and set the SSL/TLS encryption mode to Full or Full (strict).

Create Signing Request (CSR) ​

A CSR (Certificate Signing Request) is an encoded block of text generated on the server that will host the certificate. It contains the certificate details such as the domain, organization, locality and country. Use a CSR when you buy a paid certificate: create the CSR and send it to your SSL provider so they can issue the certificate.

  1. On the SSL page, select Create Signing Request (CSR)
  2. Fill in the Domain, Country, State, City, Organization and Department fields
  3. Click Submit

The new CSR appears in the Certification List. Click the eye icon in the CSR column to view and copy the CSR to send to your provider. When you receive the certificate, click Install Certificate on that row, paste the certificate and click Install Certificate.

Install existing certificate ​

If you already have a private key and certificate from another service, you can install them directly for your website.

  1. On the SSL page, select Install Existing Certificate
  2. Paste the certificate into the Certificate field and the private key into the Private Key field
  3. (Optional) Check Automatically activate the certificate after installation
  4. Click Install Existing Certificate

Clone certificate ​

You can clone a certificate already installed on your FlashPanel servers to this website, for example to share a wildcard certificate across several sites.

  1. On the SSL page, select Clone Certificate
  2. Select the certificate to clone (optionally check Automatically activate the certificate after clone)
  3. Click Clone Certificate

Manage SSL certificates ​

The Certification List table shows the website's certificates. Here you can:

  • Click Renew & Activate to manually renew a free certificate (Let's Encrypt, ZeroSSL). Other certificates show the Installed status
  • Toggle the switch in the Status column to activate or deactivate a certificate (Activated / Not activated)
  • Click the delete icon in the Action column to delete a certificate

Install a Cloudflare Origin certificate manually ​

If you prefer not to connect the Cloudflare API to FlashPanel, you can create a Cloudflare Origin certificate yourself (free, valid for up to 15 years) and install it with Install Existing Certificate.

  1. In the Cloudflare dashboard, select your domain > SSL/TLS and set the encryption mode to Full
  2. Open SSL/TLS > Origin Server and click Create Certificate
  3. Keep the default options (key format PEM) and click Create. Cloudflare shows two boxes: Origin Certificate and Private Key. Copy both right away, because Cloudflare does not show the private key again after you leave the page
  4. Go back to FlashPanel > SSL page > select Install Existing Certificate
  5. Paste the Origin Certificate content into the Certificate field and the Private Key content into the Private Key field
  6. Click Install Existing Certificate

Troubleshooting ​

Let's Encrypt cannot connect to port 80 ​

Installing or renewing a Let's Encrypt certificate fails with one of these errors:

text
Fetching http://domain.com/.well-known/acme-challenge/xxxx: Timeout during connect (likely firewall problem)
Fetching http://domain.com/.well-known/acme-challenge/xxxx: Connection refused
Fetching http://domain.com/.well-known/acme-challenge/xxxx: Connection reset by peer
Fetching http://domain.com/.well-known/acme-challenge/xxxx: Error getting validation data
Invalid response from http://domain.com/.well-known/acme-challenge/xxxx: 522

To confirm you own the domain, Let's Encrypt connects to your server over HTTP on port 80. These errors mean the connection failed. Error 522 comes from Cloudflare: Cloudflare could not connect to your server.

Before sending the request to Let's Encrypt, FlashPanel also checks port 80 from the outside. When the port is blocked, the event output includes a line Port 80 on ... is not reachable from the internet or ... is rejected by a firewall on the server.

  1. Your provider's firewall: allow inbound TCP traffic on port 80 (and 443 for your websites) from any address (0.0.0.0/0, and ::/0 for IPv6). The name depends on the provider:

    ProviderWhere to open the port
    AWS EC2The instance's Security Groups
    AWS LightsailThe Networking tab, see Open ports on AWS Lightsail
    Google CloudVPC network > Firewall
    AzureThe virtual machine's Network security group
    Oracle CloudThe subnet's Security List (or Network Security Group)
    Alibaba Cloud, Tencent CloudThe instance's Security Group

  2. The server's firewall: on the server's Firewall Rules page, check that port 80 is allowed. If the output includes rejected by a firewall on the server (no route to host), the server still has a blocking iptables rule shipped with the provider's image (common on Oracle Cloud). Run these commands as root to remove it:

    bash
    iptables -D INPUT -j REJECT --reject-with icmp-host-prohibited
iptables -D FORWARD -j REJECT --reject-with icmp-host-prohibited
sed -i '/-j REJECT --reject-with icmp-host-prohibited/d' /etc/iptables/rules.v4

    WARNING

    Do not run iptables -F or ufw reset on Oracle Cloud: they also remove Oracle's system rules and can stop the server from booting.

  3. Country blocking: Let's Encrypt validates from several locations around the world. An error containing During secondary validation means some of those locations are blocked. Turn off rules that only allow certain countries (in your firewall, Cloudflare or your provider's DDoS protection) while installing the certificate.

  4. DNS records: the domain must point to this server (the domain list on the SSL page shows a green check mark). If the domain also has an AAAA (IPv6) record, Let's Encrypt tries IPv6 first: make sure that record points to this server's IPv6 address, or delete it.

  5. Web server: Connection refused also happens when no web server listens on port 80. Check that Nginx (or Apache, OpenLiteSpeed) is running on the server's Systemd Service page.

Then install the certificate again.

Invalid response: 404 ​

Installing or renewing a Let's Encrypt certificate fails with:

text
103.1.2.3: Invalid response from http://domain.com/.well-known/acme-challenge/xxxx: 404

Let's Encrypt reached a web server but could not find the verification file. The accompanying 403 ("status":403) is only Let's Encrypt's response status; the web server's real status is the 404 at the end of the line. The IP address at the start of the line is where Let's Encrypt connected.

  1. The domain points to another server: if the IP at the start of the error is not this server's IP, fix the A record (and AAAA if any) to point to this server.
  2. The domain goes through Cloudflare: the IP at the start of the error belongs to Cloudflare. In the Cloudflare dashboard, check that the domain's DNS record points to this server's IP. If it still fails, temporarily switch the record to DNS only (grey cloud), install the certificate, then turn the proxy back on.
  3. The web server configuration was changed: if the output includes Challenge path self-check failed, the site's web server configuration no longer serves /.well-known/acme-challenge/. Check your custom configuration blocks and redirect rules on the Web server configuration page, then click Sync to write the configuration again.
  4. A redirect to another domain: Let's Encrypt follows redirects. If the domain redirects to a domain that is not hosted on this server, the verification file cannot be found. Turn the redirect off while installing the certificate.

Then install the certificate again.

Invalid response: 403 ​

Installing or renewing a Let's Encrypt certificate fails with:

text
103.1.2.3: Invalid response from http://domain.com/.well-known/acme-challenge/xxxx: 403

The web server, or a protection layer in front of it, refused Let's Encrypt's verification request.

  1. Application firewall: temporarily turn off 8G Firewall, custom configuration blocks with deny directives on the Web server configuration page, or your website's security plugin, then try again.
  2. Cloudflare: check that Security > WAF, Bot Fight Mode and country blocking rules do not block the /.well-known/acme-challenge/ path.
  3. Country blocking: an error containing During secondary validation means Let's Encrypt is blocked at some locations outside your country. See step 3 in Let's Encrypt cannot connect to port 80.

Then install the certificate again.

Invalid response: content other than the verification file ​

Installing or renewing a Let's Encrypt certificate fails with one of these errors:

text
103.1.2.3: Error reading HTTP response body: reader size limit exceeded
103.1.2.3: Invalid response from http://domain.com/.well-known/acme-challenge/xxxx: "<!DOCTYPE html>...
103.1.2.3: Invalid response from http://domain.com/.well-known/acme-challenge/xxxx: 500

The verification file is only a few dozen characters long. These errors mean Let's Encrypt received something else: an HTML page (a long page gives reader size limit exceeded) or an error code such as 500 or 502. The verification request did not reach the folder holding the verification file on this server.

  1. The domain goes through Cloudflare or a CDN: if the IP at the start of the error belongs to Cloudflare, check that the domain is still served by this server and not by Cloudflare Pages, Workers or another server. If you no longer use this server for the domain, delete the certificate to stop auto-renewal. If you do, temporarily switch the record to DNS only (grey cloud), install the certificate, then turn the proxy back on, or use a Cloudflare Origin certificate.
  2. The domain points to another server: if the IP at the start of the error is not this server's IP, fix the A record (and AAAA if any) to point to this server.
  3. An application takes over the verification path: if the output includes Challenge path self-check failed, the web server passes /.well-known/acme-challenge/ requests to your application (usually a single-page app or a reverse proxy). Check your custom configuration blocks on the Web server configuration page, then click Sync to write the configuration again. If the application installed its own web server configuration, remove that configuration for this domain.

Then install the certificate again.

Redirect loop detected ​

Installing or renewing a Let's Encrypt certificate fails with:

text
2606:4700:3034::ac43:b6b6: Fetching https://domain.com/.well-known/acme-challenge/xxxx: redirect loop detected

Let's Encrypt follows redirects and was sent back to the same address again and again. The usual case is a domain behind Cloudflare with the Flexible encryption mode: Cloudflare calls your server over HTTP, the server has Force SSL turned on and redirects to HTTPS, Cloudflare calls the server over HTTP again, and so on forever. Visitors get ERR_TOO_MANY_REDIRECTS for the same reason.

  1. Cloudflare encryption mode: open SSL/TLS > Overview and choose Full. Once the server has a valid certificate, switch to Full (strict).
  2. Redirect rules: check that Rules > Redirect Rules and Page Rules in Cloudflare, and the redirect rules on the Web server configuration page, do not redirect an address to itself.

Then install the certificate again.

DNS problem: NXDOMAIN ​

Installing or renewing a Let's Encrypt certificate fails with:

text
DNS problem: NXDOMAIN looking up A for domain.com - check that a DNS record exists for this domain

NXDOMAIN means DNS reports that the domain does not exist, so Let's Encrypt cannot find a server to validate. The 400 code that comes with it is only the status code of the Let's Encrypt response; the cause is the domain's DNS, not your server. The error names the domain that does not resolve (for example www.domain.com).

This error can also appear when auto-renewing a certificate that used to work, usually because the domain was just suspended or expired. Check in order:

  1. Domain status: run a WHOIS lookup (for example at lookup.icann.org) and look at Domain Status. If it shows clientHold or serverHold, the registrar has removed the domain from DNS. Common reasons: the registrant email was not verified, a payment is missing, or the domain was locked after an abuse report. Contact your registrar to lift the hold.
  2. Expiration: check the expiration date (Registry Expiry Date) and renew the domain if needed.
  3. Nameservers: the nameservers set at your registrar must be where you manage the DNS records.
  4. DNS records: create an A record pointing to the server's IP (and AAAA if you use IPv6) for the exact domain named in the error.

After fixing it, wait for DNS to update (usually a few minutes, longer depending on TTL), then install the certificate again. A green check mark in the domain list on the SSL page means it is ready.

TIP

Run dig +short domain.com A or use dnschecker.org for a quick check. No result means the domain does not resolve yet.

If you no longer use the domain, delete the certificate or the site to stop auto-renewal.

No valid A records found ​

Installing or renewing a Let's Encrypt certificate fails with:

text
no valid A records found for domain.com; no valid AAAA records found for domain.com

Unlike NXDOMAIN, the domain exists but has no A or AAAA record, so Let's Encrypt does not know which server to validate. This usually happens when the record was just deleted or changed to another type, or the nameservers were just moved to a provider where the record was not created.

  1. Create an A record pointing to the server's IP for the exact domain named in the error (and AAAA if you use IPv6).
  2. If you just changed nameservers, check that the record exists at the new DNS provider.

After fixing it, wait for DNS to update, then install the certificate again. If you no longer use the domain, delete the certificate or the site to stop auto-renewal.

Domain suspended by VNNIC ​

Installing or renewing a Let's Encrypt certificate for a .vn domain fails, and the error contains the address 117.122.125.107 and the Trung tâm Internet Việt Nam (Vietnam Internet Network Information Center) page:

text
117.122.125.107: Invalid response from http://domain.vn/: "<!DOCTYPE html>...<title>Trung tâm Internet Việt Nam (...

VNNIC has suspended the domain: its DNS now points to a VNNIC server, so Let's Encrypt and your visitors get the VNNIC notice page instead of your website. The usual reason is that the domain holder's information has not been updated or verified as required.

  1. Contact your registrar (where you bought the domain) to find out why it was suspended and complete the process, usually updating the domain holder's information and documents.
  2. Once the domain works again, check that its A record still points to the server's IP.

Then install the certificate again. Nothing needs to change on the server.

Let's Encrypt rate limits ​

Installing or renewing a Let's Encrypt certificate fails with a rateLimited error (code 429), for example:

text
too many certificates (5) already issued for this exact set of identifiers in the last 168h0m0s, retry after 2026-07-29 00:54:57 UTC
too many failed authorizations (5) for "domain.com" in the last 1h0m0s, retry after 2026-10-21 07:49:57 UTC

Let's Encrypt limits how often certificates can be issued to protect its service. The two common limits:

  • 5 certificates per week for the same set of domains: usually from deleting and recreating the site (or the certificate) with the same domain several times. Each recreation issues a new certificate.
  • 5 failed validations per hour for a domain: usually from clicking install again and again while the previous error (port 80, DNS...) is not fixed yet.

The time after retry after (UTC) is when you can try again. In the meantime:

  1. Read the error of the previous attempts in the event list and fix the root cause before trying again.
  2. Do not delete and recreate the site just to reinstall the certificate.
  3. If you need HTTPS right away, install ZeroSSL instead: Let's Encrypt limits do not apply to ZeroSSL.

See all limits at letsencrypt.org/docs/rate-limits.

SSL errors with Cloudflare ​

If the domain goes through Cloudflare and the browser shows an SSL error, or Cloudflare shows error 525 or 526, check two settings in the Cloudflare dashboard:

  1. Encryption mode: open SSL/TLS > Overview and choose Full (strict). This mode requires a valid certificate on your server: install a free certificate (Let's Encrypt, ZeroSSL) or a Cloudflare Origin certificate first.
  2. Proxy status: open DNS > Records and find the domain's A or CNAME record. A grey cloud (DNS only) means traffic skips Cloudflare and goes straight to your server, so the Cloudflare certificate is not used. Click the cloud to turn it orange (Proxied).

Clear the browser cache and open the website again.