How to Install a Free Let's Encrypt SSL Certificate in Plesk

Plesk’s SSL It! extension obtains and renews free Let’s Encrypt SSL certificates for your websites. You request one under Websites & Domains > your domain > SSL/TLS Certificates. This guide is for Noiz Plesk hosting customers and covers the decisions that matter: which names to include, whether validation can reach them, and how to keep HTTPS working after the first certificate is installed.

Last reviewed: 13 October 2026, against the current Plesk Obsidian release. This guide is written for Noiz hosting and is kept current against Plesk. It complements, and does not replace, the official Plesk documentation linked below.

Official Documentation Reference

• Securing Connections with the SSL It! Extension (Plesk customer guide): the certificate controls and security options.
• SSL It! wildcard and renewal details (Plesk administrator guide)
• Protecting Webmail and Mail with SSL/TLS Certificates (Plesk customer guide)
• Let’s Encrypt challenge types and IPv6 validation

Prerequisites

• Access to the domain in Plesk, and to its authoritative DNS settings or someone who can make DNS corrections. If SSL/TLS Certificates or the free certificate option is missing, ask us to check your permissions.
• The domain pointing at your Noiz hosting. See How to Point Your Domain to Noiz Hosting.

Check That Validation Can Succeed

For the usual HTTP validation, every selected name must resolve to a server that can answer Let’s Encrypt’s challenge on port 80. Check both the A (IPv4) and AAAA (IPv6) records. Let’s Encrypt tries the AAAA address first and only falls back to IPv4 on a connection timeout, so a wrong AAAA record usually causes the failure.

An ordinary redirect from HTTP to HTTPS does not block validation. Password protection, a redirect to another server, or a security rule that blocks /.well-known/acme-challenge/ can. Do not disable site-wide protection to troubleshoot it.

If you are moving an existing HTTPS site, plan certificate continuity before switching DNS. Pointing visitors at the new server before it has a valid certificate can cause warnings or an outage. In practice this means installing a working certificate on the new server before you change DNS, which we can arrange for you as part of a migration. Keep the old service running while cached DNS answers remain in use.

Choose Only the Names You Need

Each checkbox in SSL It! adds a name to the certificate, and every selected name must validate.

Plesk option	When to select it
Secure the main domain name	Almost always. Covers the bare name, such as yourdomain.com.
Include a “www” subdomain for the domain and each selected alias	When visitors use www or an alias, even if it only redirects.
Secure webmail on this domain	Only when webmail for the domain is hosted on Noiz and its name resolves correctly.
Assign the certificate to mail domain	When your mail app connects to mail.yourdomain.com. Then check the app’s incoming and outgoing server names match. How to Access Your Plesk Mailbox in Gmail lists the mail server names we use.
Secure the wildcard domain (including www and webmail)	Only when you need many subdomains and the DNS requirement below is met.

yourdomain.com is an example to replace with your own domain. A wildcard for *.yourdomain.com covers shop.yourdomain.com, but neither yourdomain.com itself nor eu.shop.yourdomain.com.

Wildcard certificates are validated through DNS rather than the website. SSL It! can issue them automatically only when Plesk manages the domain’s live DNS, either as the primary DNS server or through a DNS service synchronised with Plesk. If you are not sure that applies to your domain, ask us before choosing a wildcard. Do not change nameservers just to make the checkbox work.

Install the Certificate

1. Go to Websites & Domains and open the domain’s SSL/TLS Certificates.
2. Click Install for the free certificate from Let’s Encrypt. On some layouts it sits under More options.
3. Tick only the names you need, using the table above.
4. Click Get it free and wait for Plesk to confirm the certificate is installed.

A subdomain needs its own certificate unless you use a wildcard; see How to Add a Subdomain in Plesk.

Verify HTTPS Before Redirecting Visitors

1. Open each selected website and webmail name over HTTPS.
2. Check the browser’s certificate details for the hostname and expiry date.
3. Test important pages and forms. If mail coverage changed, test sending and receiving with your mail app as well.
4. Once those checks pass, turn on Redirect from http to https and test the HTTP addresses again.

The redirect applies to webmail as well as the website, so turn it on only once webmail works over HTTPS (see How to Access Email from Plesk Webmail). Fix mixed-content errors in the application rather than suppressing browser warnings.

Leave HSTS off during initial setup or migration. Turn it on only when you can maintain valid HTTPS for its full Max-age, including every subdomain you choose to cover. Browsers can keep the policy after you turn the option off; restoring valid HTTPS is the recovery priority.

OCSP Stapling has no effect on Let’s Encrypt certificates. Let’s Encrypt switched off its OCSP service in August 2025 and now publishes revocation information through certificate revocation lists.

Keep Renewal Working

SSL It! renews free Let’s Encrypt certificates automatically 30 days before they expire, but DNS and validation must keep working. Check expiry and renewal errors after DNS or hosting changes. Keep websites secured reissues the certificate to cover newly added domains, subdomains, aliases and webmail; it is not a guarantee against expiry or failed validation.

Troubleshooting

Symptom: issuance or renewal fails. Use the exact error to check the affected name, its A and AAAA answers, challenge access and any CAA restriction on certificate issuance. Fix the cause before retrying.

Symptom: a rate-limit error. Wait for the retry time in the error and check the current Let’s Encrypt limits rather than reissuing repeatedly.

Symptom: a wildcard renewal fails. Keep the existing valid certificate assigned while investigating. Do not delete validation TXT records blindly: several values can belong to active requests.

Need a Hand?

If issuance or renewal remains blocked, or you are on a managed Noiz plan and would prefer us to handle it, contact our support team with the domain, the selected names and the exact error. Never send a private key.