# BT Panel and aaPanel SSL: Let's Encrypt, force HTTPS, renewal > Get a free Let's Encrypt certificate in BT Panel (宝塔) or aaPanel by file or DNS verification, deploy your own, force HTTPS, keep renewal working. Source: https://ssl.sh/guides/bt-panel-ssl/ Last updated: 2026-11-10 BT Panel (宝塔面板) gets a free Let's Encrypt certificate from a site's **SSL** tab by file or DNS verification, or deploys your own certificate there. Switch on **强制 HTTPS** to redirect HTTP, and the panel's scheduled task renews the certificate. The steps apply to the BT Linux panel 9.x and later. Its interface is in Chinese, so each Chinese label is given with its English meaning; labels vary slightly between versions. The last section covers aaPanel, the English-language panel. ## Prerequisites Let's Encrypt must be able to verify that you control the domain. - BT Panel installed, with the site created under **网站** (Website) and bound to `example.com` and `www.example.com`. - An `A` record for each name pointing at the server's public IP, for example `203.0.113.10`. - For a server in mainland China, an ICP filing for the domain. Hosting providers in the mainland block or take down websites on unfiled domains, and that blocks validation requests too. - For file verification: ports 80 and 443 open in the cloud provider's security group and on the panel's **安全** (Security) page. - For DNS verification: the domain's DNS at a provider the panel supports (Alibaba Cloud DNS, DNSPod, Cloudflare and others) and an API key limited to DNS management. ## Step 1: Open the site's SSL settings In BT Panel go to **网站** (Website), click **设置** (Settings) next to the site, and open the **SSL** tab. It shows the current certificate status and the options for a free certificate or your own. ## Step 2: Request a Let's Encrypt certificate Let's Encrypt validates the domain by file or by DNS. Choose Let's Encrypt on the SSL tab (some versions place it under an entry for test or free certificates) and pick a method: - **文件验证** (file verification): the panel writes a challenge file into the site directory and Let's Encrypt fetches it over port 80. Tick the names to include (`example.com`, `www.example.com`) and apply. - **DNS 验证** (DNS verification): pick the DNS provider API and, the first time, enter the AccessKey/SecretKey or token. The panel adds and removes the `_acme-challenge` TXT records itself. This is the only way to get a wildcard such as `*.example.com`. When the certificate is issued, the panel deploys it to the site and reloads Nginx or Apache. ## Step 3 (optional): Deploy your own certificate For a certificate from Alibaba Cloud, Tencent Cloud or a commercial CA, use the option for an existing certificate on the SSL tab and fill in two fields: - **密钥（KEY）** (key): the private key, starting with `-----BEGIN PRIVATE KEY-----` or `-----BEGIN RSA PRIVATE KEY-----`. - **证书（PEM 格式）** (certificate, PEM): the complete chain, leaf certificate first, then intermediates. Nginx-format downloads from cloud providers usually already include the intermediate. Save, and the panel writes the configuration and reloads the server. See [install an intermediate certificate](https://ssl.sh/guides/install-intermediate-certificate/) for why the chain matters. ## Step 4: Force HTTPS Once the certificate works, switch on **强制 HTTPS** (force HTTPS) on the SSL tab. The panel adds the redirect to the site configuration; do not add a second redirect in rewrite rules or the config file. After the whole site works over HTTPS, consider HSTS as described in [enable HSTS](https://ssl.sh/guides/enable-hsts/). ## Verify A working site presents the Let's Encrypt certificate (or your own) and redirects HTTP to HTTPS. Check it with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal: ```bash curl ssl.sh/example.com curl -sI http://example.com | grep -iE '^(HTTP|location)' ``` On the server, BT Panel usually keeps site certificates under `/www/server/panel/vhost/cert//`; the directory name follows the site name: ```bash openssl x509 -in /www/server/panel/vhost/cert/example.com/fullchain.pem -noout -subject -issuer -dates ``` ## Automatic renewal BT Panel adds a scheduled task (visible on the **计划任务** page, Scheduled tasks) that checks Let's Encrypt certificates daily and renews and redeploys them before expiry. Keep it working: - Do not delete or disable the task, and look at its log for errors now and then. - Keep validation possible: port 80 reachable and the challenge path unblocked for file verification, a valid API key for DNS verification. - Expect more frequent renewals: Let's Encrypt's default certificates shrink to 64 days on February 10, 2027 and 45 days on February 16, 2028. Let's Encrypt stopped sending expiry emails on June 4, 2025. Besides the panel's own alerts, add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development). ## aaPanel aaPanel is the English-language panel that its official forum describes as the international version of BT Panel. According to the aaPanel documentation, you open a site's settings by clicking the site name or **Conf**, then the **SSL** section, where you can enable HTTPS, manage existing certificates or apply for Let's Encrypt: - **File verification**: Let's Encrypt checks a file on the site. Fix DNS, redirect or proxy problems before retrying, because repeated failures count against Let's Encrypt's rate limits. - **DNS verification**: supports wildcard certificates. With a supported DNS provider (the docs name Cloudflare) the panel uses the provider's API; otherwise you add the TXT record by hand and keep the dialog open until it resolves. Certificates validated with a manually added TXT record are not renewed automatically, so use the API option for anything long-lived. - **Curr, other Certs**: view, disable or save the site's current certificate, or paste your own key and certificate chain. The same advice applies: open port 80 for file verification, paste the full chain for your own certificates, and monitor expiry independently. ## Troubleshooting - **Validation fails or times out**: port 80 is closed, the domain is blocked for lack of an ICP filing, DNS has not propagated or points at a CDN; the causes match [certbot timeout during connect](https://ssl.sh/errors/certbot-timeout-during-connect/). DNS verification avoids the port problem. - **Challenge file returns 404 or 403**: rewrite rules, hotlink protection or a WAF block `/.well-known/acme-challenge/`; disable them for that path. - **too many certificates already issued**: repeated attempts hit the limits; see [Let's Encrypt rate limits](https://ssl.sh/errors/lets-encrypt-rate-limit/). - **CAA record prevents issuance**: CAA does not allow `letsencrypt.org`; see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/). - **Phones or Mini Programs distrust the certificate**: only the leaf was pasted; see [missing intermediate certificate](https://ssl.sh/errors/missing-intermediate-certificate/).