How to set up SSL in BT Panel and aaPanel

BT Panel (宝塔面板) gets a free Let's Encrypt certificate from a site's SSL tab by file or DNS verification, or deploys your own certificate there. Switch on 强制 HTTPS to redirect HTTP, and the panel's scheduled task renews the certificate.

The steps apply to the BT Linux panel 9.x and later. Its interface is in Chinese, so each Chinese label is given with its English meaning; labels vary slightly between versions. The last section covers aaPanel, the English-language panel.

Prerequisites

Let's Encrypt must be able to verify that you control the domain.

• BT Panel installed, with the site created under 网站 (Website) and bound to example.com and www.example.com.
• An A record for each name pointing at the server's public IP, for example 203.0.113.10.
• For a server in mainland China, an ICP filing for the domain. Hosting providers in the mainland block or take down websites on unfiled domains, and that blocks validation requests too.
• For file verification: ports 80 and 443 open in the cloud provider's security group and on the panel's 安全 (Security) page.
• For DNS verification: the domain's DNS at a provider the panel supports (Alibaba Cloud DNS, DNSPod, Cloudflare and others) and an API key limited to DNS management.

Step 1: Open the site's SSL settings

In BT Panel go to 网站 (Website), click 设置 (Settings) next to the site, and open the SSL tab. It shows the current certificate status and the options for a free certificate or your own.

Step 2: Request a Let's Encrypt certificate

Let's Encrypt validates the domain by file or by DNS. Choose Let's Encrypt on the SSL tab (some versions place it under an entry for test or free certificates) and pick a method:

• 文件验证 (file verification): the panel writes a challenge file into the site directory and Let's Encrypt fetches it over port 80. Tick the names to include (example.com, www.example.com) and apply.
• DNS 验证 (DNS verification): pick the DNS provider API and, the first time, enter the AccessKey/SecretKey or token. The panel adds and removes the _acme-challenge TXT records itself. This is the only way to get a wildcard such as *.example.com.

When the certificate is issued, the panel deploys it to the site and reloads Nginx or Apache.

Step 3 (optional): Deploy your own certificate

For a certificate from Alibaba Cloud, Tencent Cloud or a commercial CA, use the option for an existing certificate on the SSL tab and fill in two fields:

• 密钥（KEY） (key): the private key, starting with -----BEGIN PRIVATE KEY----- or -----BEGIN RSA PRIVATE KEY-----.
• 证书（PEM 格式） (certificate, PEM): the complete chain, leaf certificate first, then intermediates. Nginx-format downloads from cloud providers usually already include the intermediate.

Save, and the panel writes the configuration and reloads the server. See install an intermediate certificate for why the chain matters.

Step 4: Force HTTPS

Once the certificate works, switch on 强制 HTTPS (force HTTPS) on the SSL tab. The panel adds the redirect to the site configuration; do not add a second redirect in rewrite rules or the config file. After the whole site works over HTTPS, consider HSTS as described in enable HSTS.

Verify

A working site presents the Let's Encrypt certificate (or your own) and redirects HTTP to HTTPS. Check it with the SSL checker, or from any terminal:

curl ssl.sh/example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

On the server, BT Panel usually keeps site certificates under /www/server/panel/vhost/cert/<site>/; the directory name follows the site name:

openssl x509 -in /www/server/panel/vhost/cert/example.com/fullchain.pem -noout -subject -issuer -dates

Automatic renewal

BT Panel adds a scheduled task (visible on the 计划任务 page, Scheduled tasks) that checks Let's Encrypt certificates daily and renews and redeploys them before expiry. Keep it working:

• Do not delete or disable the task, and look at its log for errors now and then.
• Keep validation possible: port 80 reachable and the challenge path unblocked for file verification, a valid API key for DNS verification.
• Expect more frequent renewals: Let's Encrypt's default certificates shrink to 64 days on February 10, 2027 and 45 days on February 16, 2028.

Let's Encrypt stopped sending expiry emails on June 4, 2025. Besides the panel's own alerts, add the domain to ssl.sh monitoring (in development).

aaPanel

aaPanel is the English-language panel that its official forum describes as the international version of BT Panel. According to the aaPanel documentation, you open a site's settings by clicking the site name or Conf, then the SSL section, where you can enable HTTPS, manage existing certificates or apply for Let's Encrypt:

• File verification: Let's Encrypt checks a file on the site. Fix DNS, redirect or proxy problems before retrying, because repeated failures count against Let's Encrypt's rate limits.
• DNS verification: supports wildcard certificates. With a supported DNS provider (the docs name Cloudflare) the panel uses the provider's API; otherwise you add the TXT record by hand and keep the dialog open until it resolves. Certificates validated with a manually added TXT record are not renewed automatically, so use the API option for anything long-lived.
• Curr, other Certs: view, disable or save the site's current certificate, or paste your own key and certificate chain.

The same advice applies: open port 80 for file verification, paste the full chain for your own certificates, and monitor expiry independently.

Troubleshooting

• Validation fails or times out: port 80 is closed, the domain is blocked for lack of an ICP filing, DNS has not propagated or points at a CDN; the causes match certbot timeout during connect. DNS verification avoids the port problem.
• Challenge file returns 404 or 403: rewrite rules, hotlink protection or a WAF block /.well-known/acme-challenge/; disable them for that path.
• too many certificates already issued: repeated attempts hit the limits; see Let's Encrypt rate limits.
• CAA record prevents issuance: CAA does not allow letsencrypt.org; see CAA record prevents issuance.
• Phones or Mini Programs distrust the certificate: only the leaf was pasted; see missing intermediate certificate.