Skip to content
NoizNoizNoiz < Knowledgebase

How to Secure a Website with a Free SSL Certificate in DirectAdmin

DirectAdmin issues and renews free Let’s Encrypt SSL certificates automatically once ACME is switched on for a domain under Account Manager > SSL/TLS Certificates > ACME settings. ACME is the automated protocol Let’s Encrypt uses to check that you control a name and then issue and renew its certificate.

This guide covers what to check before switching it on, how to confirm the certificate visitors actually receive, and how to redirect visitors to HTTPS once it works. Read yourdomain.com throughout as your own domain name.

Last reviewed: 13 October 2026, against the current DirectAdmin release and its Evolution interface. This guide is kept current against DirectAdmin. It complements, and does not replace, the official DirectAdmin documentation linked below.

Official Documentation Reference

Section titled “Official Documentation Reference”

Prerequisites

Section titled “Prerequisites”
  • Your DirectAdmin login. See How to Log In to DirectAdmin.
  • A list of every website name that needs HTTPS: usually the bare domain and www, plus any subdomains in use.
  • Each of those names resolving to your DirectAdmin server. See How to Manage DNS Records in DirectAdmin.
  • A note of the current certificate status, covered names, expiry date and redirect settings. If a working certificate is managed by someone else or another service, agree who owns renewal before replacing it.

Choose How Ownership Is Validated

Section titled “Choose How Ownership Is Validated”

Let’s Encrypt only issues a certificate for a name once it has checked that you control it. The method decides what must be ready:

  • HTTP validation: each requested name must reach this server on port 80 and answer the challenge. If a name has several addresses, each one must answer correctly, and a proxy in front of the site must pass the challenge through. Check both the A record and any AAAA (IPv6) record: a wrong IPv6 answer can fail validation even when IPv4 works. See Let’s Encrypt’s IPv6 guidance.
  • DNS validation: a TXT record must be published in the DNS that the internet sees. Wildcard certificates (*.yourdomain.com) can only be validated this way. If you need a wildcard, ask your server administrator or hosting provider to confirm DNS validation is available for the domain. If the domain’s DNS is hosted elsewhere, DirectAdmin needs that DNS provider’s integration, set up in the external DNS provider section of ACME settings.

Enable Automatic Certificates for the Domain

Section titled “Enable Automatic Certificates for the Domain”
  1. Log in to DirectAdmin.
  2. In the Account Manager section, click SSL/TLS Certificates. If you cannot see it, type SSL/TLS Certificates into the panel’s search box. Check that the correct domain is selected.
  3. Open ACME settings. If the page offers a choice of certificate provider, choose Let’s Encrypt.
  4. Switch ACME on for the domain and save.
  5. Back on SSL/TLS Certificates, read the status for each name you need. If a name is waiting, trigger provisioning on demand from that page rather than waiting for the daily run.
  6. If a name fails, read the reported problem before trying again. Repeated requests do not repair a DNS or reachability fault.

If ACME settings is missing, ask your server administrator or hosting provider to check the account’s access and certificate configuration.

To use an external DNS provider for DNS validation, fill in the provider’s details in the external DNS provider section of ACME settings. Whether your provider is offered depends on the server; ask your server administrator or hosting provider if it is not listed. Give the provider’s API credential only the DNS permissions and zones it needs, and keep it out of screenshots and support messages.

Check Coverage Before Redirecting Visitors

Section titled “Check Coverage Before Redirecting Visitors”

Open every intended HTTPS address in a fresh private browser window. Each must show the correct site without a certificate warning. Then inspect the certificate’s names and validity dates:

  • yourdomain.com and www.yourdomain.com each need to be covered, even when one redirects to the other.
  • A wildcard *.yourdomain.com covers shop.yourdomain.com, but not the bare domain or a.b.yourdomain.com. A certificate may list both the wildcard and the bare domain.
  • A subdomain’s www. form, such as www.shop.yourdomain.com, is a separate name. Current DirectAdmin releases do not serve or certify it unless it is created as its own subdomain.

DirectAdmin can group several names into one certificate or split them across several, so check the issued result rather than assuming one certificate per name.

A working website certificate says nothing about mail, FTP or the control panel itself. Keep using the connection names supplied for those services.

Redirect HTTP to HTTPS After It Works

Section titled “Redirect HTTP to HTTPS After It Works”

If the site does not already redirect to HTTPS:

  1. Note the current redirect settings.
  2. Turn on Force SSL with https redirect. It is in Account Manager > Domain Setup under your domain, and also at the bottom of the SSL/TLS Certificates page.
  3. Test the HTTP and HTTPS addresses, an inner page, and the site’s login or forms.

The separate Force Redirect setting in Domain Setup chooses between www and the bare domain; it is not the HTTPS switch. Keep the site’s existing preferred name unless you mean to change it. See DirectAdmin’s redirect settings.

If the redirect causes a loop, turn it off first. Then check the application’s own redirect settings and any proxy’s HTTPS handling. Do not delete the whole .htaccess file or disable unrelated rules. If pages load but images or scripts fail, look for resources still requested over http://.

Keep Renewal Working

Section titled “Keep Renewal Working”

Leave ACME switched on and keep the validation route working. DirectAdmin checks certificates once a day and renews each one when it has used a set share of its lifetime, so a daily check does not mean a new certificate every day. See the renewal calculation notes.

After changing DNS, hosting or a proxy, check the certificate status again, and act on failure notices before the certificate expires. When a name fails repeatedly, DirectAdmin adds it to the ACME exclusions list in ACME settings and stops trying. Fix the cause before removing the name from that list. Do not remove exclusions you added on purpose for names whose certificates are managed elsewhere.

Troubleshooting

Section titled “Troubleshooting”
  • Validation fails: open Provisioning history on the SSL/TLS Certificates page to see recent attempts and the exact error, then check HTTP reachability or the published DNS accordingly.
  • A CAA error appears: a CAA record is a DNS record that names which certificate authorities may issue for the domain. The applicable policy must allow Let’s Encrypt; it can be inherited from a parent name or reached through an alias, and wildcard rules can differ. Correct the policy without removing unrelated restrictions. If the zone is in DirectAdmin and DNS Management does not offer CAA records, ask your server administrator or hosting provider, as they are not available by default. See Let’s Encrypt’s CAA guidance.
  • A rate limit is reported: fix the underlying fault and wait for the retry time given in the error. Do not switch to a wildcard just to get around the limit. See Let’s Encrypt rate limits.
  • HTTPS shows a different or empty site while HTTP is correct: DirectAdmin serves HTTPS from the domain’s private_html folder. In Account Manager > Domain Setup, open the domain and check that private_html is set to use a symbolic link to public_html. See DirectAdmin Site-Helper: uploading files to your secure site.
  • The panel shows a certificate but the browser warns: check the exact hostname, the expiry date and the certificate actually presented, including by a proxy if there is one. Do not click through the warning.
  • Certificate controls are missing: ask your server administrator or hosting provider to check the account’s access and certificate configuration.
Section titled “Related Guides”

Need a Hand?

Section titled “Need a Hand?”

Noiz supports customers who run their own DirectAdmin servers. If a certificate will not issue and you need a hand, contact Noiz support with the affected hostname, the time and the exact error text. Never include a private key or a DNS API credential. Keep a working certificate in place while a failed replacement is investigated.

[noiz] | disrupt the signal