FlashPanel

SSL ​

FlashPanel can issue free SSL certificates from Let's Encrypt, ZeroSSL and Cloudflare, and can install certificates you bought elsewhere. Open SSL in the site's menu to get started. The page has two parts: Install Certificate (the ways to install) and Certification List (the site's certificates).

Let's Encrypt ​

Let's Encrypt provides free SSL certificates recognized by all major browsers.

FlashPanel automatically renews Let's Encrypt certificates once they are 21 days or less from expiration. Renewal runs at a random time of day to avoid overloading the Let's Encrypt servers. You can also renew manually from the Certification List.

Steps to install a Let's Encrypt certificate:

  1. On the site's SSL page, select the Let's Encrypt (Free) card
  2. Check the domain list: each row shows the domain, the IP it currently points to and a green check mark if it points to the server. Domains must point to the server for the certificate to be issued
  3. (Optional) Check Automatically activate the certificate after installation
  4. Click Install Let's Encrypt

TIP

If the domain uses Cloudflare DNS with the proxy enabled (orange cloud), the domain check result may not be accurate.

WARNING

Due to the Let's Encrypt renewal process, Let's Encrypt certificates cannot be cloned to other sites. Issue a new Let's Encrypt certificate for that website instead.

ZeroSSL ​

ZeroSSL is a free SSL certificate provider recognized by all major browsers.

Follow the same steps as Let's Encrypt (select the ZeroSSL (Free) card). FlashPanel registers with ZeroSSL using the site owner's email, so you don't need to create a ZeroSSL account first. ZeroSSL certificates are renewed automatically just like Let's Encrypt.

SSL for IP addresses ​

FlashPanel can issue free SSL certificates for your server's IP addresses (both IPv4 and IPv6) via Let's Encrypt. This is useful when you need HTTPS access to your server or API before you have a domain. To use it, create a website whose domain is the server's IP address, then install a Let's Encrypt certificate as usual.

  • Renewal: IP certificates have a very short lifespan (about 6 days), so FlashPanel renews them automatically once they have 4 days (96 hours) or less left.
  • Requirements: Port 80 must be open for Let's Encrypt validation.

Cloudflare ​

If your domain uses Cloudflare DNS, FlashPanel can automatically create and install a 15-year Cloudflare Origin certificate, with no periodic renewal like Let's Encrypt or ZeroSSL.

Requirements:

  • You have added your Cloudflare credentials to FlashPanel and the domain belongs to that Cloudflare account. See Connect DNS Provider. The API key needs the SSL and Certificate permission.
  • The certificate only supports the root domain or first-level subdomains (for example domain.com, app.domain.com).

Steps to install:

  1. On the site's SSL page, select the Cloudflare card
  2. Click Install Cloudflare

TIP

Cloudflare Origin certificates are only trusted by browsers when traffic goes through the Cloudflare proxy. In Cloudflare, enable the proxy for the DNS record and set the SSL/TLS encryption mode to Full or Full (strict).

Create Signing Request (CSR) ​

A CSR (Certificate Signing Request) is an encoded block of text generated on the server that will host the certificate. It contains the certificate details such as the domain, organization, locality and country. Use a CSR when you buy a paid certificate: create the CSR and send it to your SSL provider so they can issue the certificate.

  1. On the SSL page, select Create Signing Request (CSR)
  2. Fill in the Domain, Country, State, City, Organization and Department fields
  3. Click Submit

The new CSR appears in the Certification List. Click the eye icon in the CSR column to view and copy the CSR to send to your provider. When you receive the certificate, click Install Certificate on that row, paste the certificate and click Install Certificate.

Install existing certificate ​

If you already have a private key and certificate from another service, you can install them directly for your website.

  1. On the SSL page, select Install Existing Certificate
  2. Paste the certificate into the Certificate field and the private key into the Private Key field
  3. (Optional) Check Automatically activate the certificate after installation
  4. Click Install Existing Certificate

Clone certificate ​

You can clone a certificate already installed on your FlashPanel servers to this website, for example to share a wildcard certificate across several sites.

  1. On the SSL page, select Clone Certificate
  2. Select the certificate to clone (optionally check Automatically activate the certificate after clone)
  3. Click Clone Certificate

Manage SSL certificates ​

The Certification List table shows the website's certificates. Here you can:

  • Click Renew & Activate to manually renew a free certificate (Let's Encrypt, ZeroSSL). Other certificates show the Installed status
  • Toggle the switch in the Status column to activate or deactivate a certificate (Activated / Not activated)
  • Click the delete icon in the Action column to delete a certificate

Install a Cloudflare Origin certificate manually ​

If you prefer not to connect the Cloudflare API to FlashPanel, you can create a Cloudflare Origin certificate yourself (free, valid for up to 15 years) and install it with Install Existing Certificate.

  1. In the Cloudflare dashboard, select your domain > SSL/TLS and set the encryption mode to Full
  2. Open SSL/TLS > Origin Server and click Create Certificate
  3. Keep the default options (key format PEM) and click Create. Cloudflare shows two boxes: Origin Certificate and Private Key. Copy both right away, because Cloudflare does not show the private key again after you leave the page
  4. Go back to FlashPanel > SSL page > select Install Existing Certificate
  5. Paste the Origin Certificate content into the Certificate field and the Private Key content into the Private Key field
  6. Click Install Existing Certificate

Troubleshooting ​

Timeout during connect (likely firewall problem) ​

Installing a Let's Encrypt certificate fails with:

text
Fetching http://domain.com/.well-known/acme-challenge/xxxx: Timeout during connect (likely firewall problem)

To confirm you own the domain, Let's Encrypt connects to your server over HTTP on port 80. The connection timed out, so something in between blocks it. The Solution section in the event details links to this section.

  1. Your provider's firewall (security group, cloud firewall): allow inbound TCP traffic on port 80 from any address (0.0.0.0/0, and ::/0 for IPv6). On AWS Lightsail, see Open ports on AWS Lightsail.
  2. The server's firewall: on the server's Firewall Rules page, check that port 80 is allowed.
  3. DNS records: the domain must point to this server (the domain list on the SSL page shows a green check mark). If the domain also has an AAAA (IPv6) record, Let's Encrypt tries IPv6 first: make sure that record points to this server's IPv6 address, or delete it.

Then install the certificate again.

DNS problem: NXDOMAIN ​

Installing or renewing a Let's Encrypt certificate fails with:

text
DNS problem: NXDOMAIN looking up A for domain.com - check that a DNS record exists for this domain

NXDOMAIN means DNS reports that the domain does not exist, so Let's Encrypt cannot find a server to validate. The 400 code that comes with it is only the status code of the Let's Encrypt response; the cause is the domain's DNS, not your server. The error names the domain that does not resolve (for example www.domain.com). The Solution section in the event details links to this section.

This error can also appear when auto-renewing a certificate that used to work, usually because the domain was just suspended or expired. Check in order:

  1. Domain status: run a WHOIS lookup (for example at lookup.icann.org) and look at Domain Status. If it shows clientHold or serverHold, the registrar has removed the domain from DNS. Common reasons: the registrant email was not verified, a payment is missing, or the domain was locked after an abuse report. Contact your registrar to lift the hold.
  2. Expiration: check the expiration date (Registry Expiry Date) and renew the domain if needed.
  3. Nameservers: the nameservers set at your registrar must be where you manage the DNS records.
  4. DNS records: create an A record pointing to the server's IP (and AAAA if you use IPv6) for the exact domain named in the error.

After fixing it, wait for DNS to update (usually a few minutes, longer depending on TTL), then install the certificate again. A green check mark in the domain list on the SSL page means it is ready.

TIP

Run dig +short domain.com A or use dnschecker.org for a quick check. No result means the domain does not resolve yet.

If you no longer use the domain, delete the certificate or the site to stop auto-renewal.

SSL errors with Cloudflare ​

If the domain goes through Cloudflare and the browser shows an SSL error, or Cloudflare shows error 525 or 526, check two settings in the Cloudflare dashboard:

  1. Encryption mode: open SSL/TLS > Overview and choose Full (strict). This mode requires a valid certificate on your server: install a free certificate (Let's Encrypt, ZeroSSL) or a Cloudflare Origin certificate first.
  2. Proxy status: open DNS > Records and find the domain's A or CNAME record. A grey cloud (DNS only) means traffic skips Cloudflare and goes straight to your server, so the Cloudflare certificate is not used. Click the cloud to turn it orange (Proxied).

Clear the browser cache and open the website again.