--- title: "How to Secure a Website with a Free SSL Certificate in ISPConfig" description: "Secure a website in ISPConfig with a free Let's Encrypt SSL certificate, redirect visitors to HTTPS, and fix a certificate that fails to issue." url: "https://docs.noiz.ie/ispconfig/how-to-secure-a-website-with-a-free-ssl-certificate-in-ispconfig/" section: "ISPConfig" categories: - "Control Panels > ISPConfig > Sites & Domains" last_reviewed: "27 July 2026, against the ISPConfig release Noiz runs" --- # How to Secure a Website with a Free SSL Certificate in ISPConfig This guide shows you how to secure a website on your Noiz hosting account with a free SSL certificate from Let's Encrypt, so that visitors reach your site over an encrypted `https://` address and see the padlock in their browser. It is written for Noiz clients managing their own hosting through the ISPConfig control panel. An SSL certificate is sometimes called a TLS certificate or an HTTPS certificate; they all mean the same thing. Let's Encrypt is a free, globally trusted certificate authority, and ISPConfig requests and renews its certificates for you automatically, so there is nothing to buy and nothing to renew by hand. **Last reviewed:** 27 July 2026, against the ISPConfig release Noiz runs. This article follows the official ISPConfig manual procedure for enabling SSL on a website, cross-checked against the current interface. ISPConfig evolves between releases, so if a screen differs from this guide, check the official documentation links below. ### Official Documentation Reference - [Let's Encrypt Error FAQ (HowtoForge forum)](https://forum.howtoforge.com/threads/lets-encrypt-error-faq.74179/): the official troubleshooting FAQ for ISPConfig's Let's Encrypt integration, maintained by the ISPConfig developers. - [ISPConfig 3 Documentation](https://docs.ispconfig.org/): the current official documentation site for ISPConfig. - [ISPConfig Documentation overview](https://www.ispconfig.org/documentation/): the index of all official ISPConfig documentation, including the full manual. ## Prerequisites - You can [log in to the ISPConfig control panel](/ispconfig/how-to-log-in-to-the-ispconfig-control-panel/). - The website already exists in ISPConfig. If not, first follow [How to Create a Website in ISPConfig](/ispconfig/how-to-create-a-website-in-ispconfig/). - The domain's DNS records point at your Noiz hosting server. This matters more than usual here, as explained in the next section. ## How the Free Certificate Is Issued Before Let's Encrypt issues a certificate, it proves that you control the domain. ISPConfig places a small verification file on your website, and Let's Encrypt then tries to download that file from the public internet for **every name attached to the website**: the main domain in the **Domain** field, the auto-subdomain (usually `www.yourdomain.com`), and any alias domains or subdomains you have added to the site. Before it asks, ISPConfig runs the same test itself and leaves out any name that does not reach your hosting server, so that name is simply missing from the certificate. If none of the names reach the server, no certificate is issued, and a name that passes ISPConfig's test but then fails Let's Encrypt's own check (for example because a firewall blocks Let's Encrypt's validation servers, or an IPv6 record points elsewhere) makes the whole request fail. This is why DNS must be right first: - Every name on the site, for example `yourdomain.com` and `www.yourdomain.com`, must resolve to the Noiz hosting server from the public internet. - If you have only just pointed the domain at Noiz, allow time for DNS propagation. Changes usually take effect within minutes to a few hours, but can take up to 24 hours worldwide. Ticking the checkbox too early is the single most common reason the certificate fails. - If the domain sits behind an external proxy or CDN service, requests may not reach the hosting server directly. Switch such a service to DNS-only mode, or pause it, until the certificate has been issued. A quick test: open `http://yourdomain.com` and `http://www.yourdomain.com` in a browser. If both show your site (or the default welcome page) served from your Noiz account, you are ready to continue. ## Enable the Free SSL Certificate ### Open the website settings 1. Log in to the ISPConfig control panel. 2. Click the **Sites** module in the top navigation. 3. In the left menu, under **Websites**, click **Website**, then click the domain name of the site you want to secure. The **Web Domain** form opens on the **Domain** tab. ![ISPConfig Sites module with the Website list open and a website domain about to be selected for editing](/images/kb/253_ispconfig-website-list-select-site.png) ### Tick SSL and Let's Encrypt SSL 1. On the **Domain** tab, tick the **SSL** checkbox. This enables HTTPS for the website. 2. Tick the **Let's Encrypt SSL** checkbox. This tells ISPConfig to request a free certificate from Let's Encrypt and to keep renewing it automatically. Both boxes must be ticked together, and the panel enforces this for you: ticking **Let's Encrypt SSL** ticks **SSL** automatically, and unticking **SSL** clears **Let's Encrypt SSL**. 3. Click **Save**. You do not need to visit the **SSL** tab at all. That tab is for creating a self-signed certificate together with a certificate signing request (CSR), which you would use to apply for a certificate from a commercial certificate authority. With Let's Encrypt enabled, the **SSL** tab stays visible but displays a notice that everything on it applies to non-Let's Encrypt certificates only. Leave it alone; ISPConfig fills in and rotates the certificate for you. If you ever want to move to a purchased certificate instead, untick **Let's Encrypt SSL** on the **Domain** tab first. ### Wait for the certificate to be issued 1. After saving, watch for the small red change indicator near the top of the panel. It shows a count of changes not yet applied to the server, and clicking it lists what is still outstanding. ISPConfig is contacting Let's Encrypt, running the domain verification and writing the new web server configuration in the background. This normally takes a minute or two. 2. Once the indicator clears, open the website's settings again and check the **Domain** tab. If **Let's Encrypt SSL** is still ticked, the certificate was issued successfully. Important: if the verification fails, ISPConfig quietly unticks the **Let's Encrypt SSL** checkbox. If the website did not already have **SSL** switched on before you started, that box is cleared too. The panel does not show an error message, so always re-open the site and check. **Let's Encrypt SSL** is the box to watch, as it is the one that always clears on failure. If it has unticked itself, see the Troubleshooting section below. ## Verify HTTPS Is Working 1. Open `https://yourdomain.com` in a browser. Note the `https://` at the start of the address. 2. Check for the padlock icon next to the address. Click it to view the certificate details; the issuer shows as Let's Encrypt. 3. Repeat for `https://www.yourdomain.com` if the site uses the `www` auto-subdomain. Let's Encrypt certificates are valid for 90 days, and ISPConfig renews them automatically well before they expire. There is nothing you need to do for renewals; the checkbox stays ticked and the certificate keeps rotating in the background. ## Redirect All Visitors to HTTPS With the certificate in place, the site answers on both `http://` and `https://`. To make sure every visitor uses the encrypted address: 1. Open the website's settings again and click the **Redirect** tab. 2. Tick the **Rewrite HTTP to HTTPS** checkbox. 3. Click **Save** and wait for the red change indicator to clear. Anyone who now types the plain `http://` address is sent straight to the secure `https://` version. This also avoids duplicate content issues for search engines. Only enable this after you have confirmed HTTPS works, otherwise visitors would be redirected to an address that fails. This redirect does not interfere with certificate renewals. ISPConfig writes its redirect rules so that the verification path Let's Encrypt uses, `/.well-known/acme-challenge/`, is left alone. The same applies to the **SEO Redirect** options on the same tab. A redirect you add yourself, however, in an `.htaccess` file or inside your application, can block that path and cause renewal to fail, so exclude `/.well-known/` from any redirect rule you write by hand. ## Troubleshooting - **The Let's Encrypt SSL checkbox unticks itself after saving**: the Let's Encrypt verification failed, and this is by far the most common problem. Almost always, the site's names do not reach the hosting server yet, or one of them fails from outside, for example because a firewall blocks Let's Encrypt's validation servers or an IPv6 (AAAA) record points elsewhere. Check the main domain, the `www` name and every alias domain or subdomain on the site, fix the DNS records, wait for propagation, then edit the site and tick the boxes again. - **DNS was changed recently and the certificate still fails**: propagation may not have finished. Wait a few hours and try again. Repeatedly re-ticking the box within minutes does not help and can trigger temporary rate limits at Let's Encrypt, which then force a longer wait. - **The certificate fails while a proxy or CDN service sits in front of the domain**: the verification requests are not reaching the hosting server. Set the service to DNS-only mode, or pause it, tick the boxes again, and re-enable the proxy once the certificate has been issued. - **HTTPS works on `yourdomain.com` but not on `www.yourdomain.com`**: the `www` name is either missing a DNS record or is not attached to the website. Check that **Auto-Subdomain** on the **Domain** tab is set to **www.** and that a DNS record for `www` points at the server, then save and re-tick the checkboxes if needed. - **The browser shows a certificate warning straight after enabling SSL**: the new configuration may still be rolling out. Wait for the red change indicator to clear, then reload the page with a hard refresh. If the warning persists, re-open the site settings and confirm the checkboxes are still ticked. - **The padlock shows "not fully secure" or a warning triangle**: the certificate is fine, but the page loads some images, styles or scripts over plain `http://`. This is called mixed content. Update your site's own settings and content to use `https://` addresses; in WordPress, for example, change the site address settings to the `https://` version. - **An alias domain or subdomain added later broke the certificate renewal**: every name on the site is checked again when the certificate is requested. A new alias whose DNS does not reach the server is normally just left off the certificate, so it has no working HTTPS; one that reaches the server but fails Let's Encrypt's check, for example because a firewall blocks the validation servers or an IPv6 record points elsewhere, fails the request for the whole site. Make sure any name you add to the website resolves to the server before you add it. If a particular name cannot be made to resolve, for example one that is parked elsewhere, open that alias domain or subdomain and tick **Don't add to Let's Encrypt certificate** to keep it off the request entirely. If you get stuck at any point, open a support ticket with the Noiz support team and include the domain name, the approximate time you ticked the **Let's Encrypt SSL** checkbox, and whether that checkbox was still ticked when you re-opened the website settings. --- Source: https://docs.noiz.ie/ispconfig/how-to-secure-a-website-with-a-free-ssl-certificate-in-ispconfig/