How to get and configure SSL certificates in 1Panel

1Panel issues Let's Encrypt certificates under Websites → Certificates: create an ACME account, optionally a DNS account, and apply with automatic renewal on. You then enable HTTPS per website with an HTTP-to-HTTPS redirect, and 1Panel renews the certificate before it expires.

Steps and screen names follow the 1Panel v2 documentation on 1panel.pro as of November 2026. Button labels differ slightly between releases, so follow what your panel shows.

Prerequisites

1Panel needs a website for the domain plus one validation path: open ports 80 and 443 (HTTP mode) or API access to the DNS (DNS mode).

• 1Panel v2 installed, with a website (OpenResty) for example.com created under Websites.
• An A record pointing at the server's public IP, for example 203.0.113.10. If the server is in mainland China and serves a public website, the domain needs an ICP filing; hosting providers there block or take down websites on unfiled domains, including the HTTP validation requests.
• For HTTP mode: ports 80 and 443 open in the cloud security group and the server firewall.
• For DNS mode: the domain's DNS at a provider 1Panel supports, and an API key that can only manage DNS.

Step 1: Create an ACME account

Go to Websites → Certificates and click ACME Account above the certificate list. Create an account with your email address and choose the CA: Let's Encrypt, ZeroSSL, Buypass, Google Cloud, or a custom ACME server. Keep the default key type unless you need something else. The email address receives notices about the certificates.

Step 2: Create a DNS account (recommended)

On the same page, click DNS Account and create one for your DNS provider. The list includes Alibaba Cloud, Tencent Cloud, Huawei Cloud, Cloudflare, GoDaddy, Namecheap, NameSilo, Name.com, Vercel, Spaceship, Volcano Engine, ClouDNS and others. Enter the provider's API credentials (AccessKey and secret, or an API token). 1Panel then creates and deletes the validation TXT records itself during issuance and renewal.

Using a DNS account has two advantages: port 80 can stay closed, which helps servers behind home connections or strict firewalls, and wildcards become possible.

Step 3: Apply for the certificate

Apply from the certificate list with the DNS account as the verification method and automatic renewal turned on. The form fields:

• Primary domain: example.com; other domains: *.example.com or www.example.com.
• ACME account: the one from Step 1.
• Verification method: DNS account (no port 80, wildcards allowed); manual DNS (you add the TXT records shown and confirm, and renewal is not automatic); or HTTP (single names with port 80 reachable).
• Turn on automatic renewal.

Submit and watch the status and log in the certificate list. When the status shows the certificate as issued, it is ready. If you prefer Let's Encrypt's shorter 45-day tlsserver profile, read Let's Encrypt certificate profiles first and check whether your 1Panel version exposes profile selection.

Step 4: Enable HTTPS on the website

HTTPS is switched on per website, in the HTTPS section of its basic settings. Open Websites, select the site, go to its configuration and set:

• Enable HTTPS and choose the certificate issued in Step 3 (or import one by pasting its key and certificate).
• Set the HTTP option to redirect HTTP to HTTPS. The other choices allow plain HTTP or refuse it.
• Leave protocol versions at TLS 1.2 and 1.3 unless you must support old clients.
• Save. 1Panel writes the OpenResty configuration and reloads it; do not edit the generated configuration by hand.

The same section has switches for HSTS and HTTP/3. Turn HSTS on only after every page works over HTTPS; see enable HSTS.

Verify

A working setup shows Let's Encrypt as the issuer, an expiry date in the future and a 301 redirect for plain HTTP. Check the site with the SSL checker, or from any terminal:

curl ssl.sh/example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'
openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -issuer -dates

Automatic renewal

Certificates applied for with a DNS account or HTTP mode, with automatic renewal on, are renewed by 1Panel before they expire, and the websites using them are updated. The certificate list also has a Renew button for a manual run. To keep renewal working:

• Do not delete the DNS account's API key, and update the DNS account if you rotate the key. For HTTP mode, keep port 80 open and the challenge path unblocked.
• Look at the certificate list and renewal logs from time to time.
• Let's Encrypt's default certificates drop to 64 days on February 10, 2027 and 45 days on February 16, 2028, so renewals become more frequent; automatic renewal must stay on.

Let's Encrypt no longer sends expiry reminder emails (since June 4, 2025), so add the domain to ssl.sh monitoring (in development) as an independent check.

Troubleshooting

• DNS validation fails: wrong or under-privileged API key, the domain's DNS is not at the selected provider, or the TXT record has not propagated; check the DNS account and the application log.
• HTTP validation times out: port 80 is closed or the unfiled domain is blocked; the causes match certbot timeout during connect.
• CAA record prevents issuance: CAA does not allow the chosen CA; see CAA record prevents issuance.
• too many certificates already issued: repeated attempts hit the limits; see Let's Encrypt rate limits.
• A subdomain shows a name mismatch: the name is missing from the certificate, or a second-level subdomain such as a.b.example.com is outside the wildcard; see NET::ERR_CERT_COMMON_NAME_INVALID.