How to secure a Plesk website with Let's Encrypt using SSL It!

Plesk Obsidian issues free Let's Encrypt certificates through the SSL It! extension. One click on Get it free covers the domain, www and optionally webmail and mail, and SSL It! renews the certificate on its own. A switch on the same page redirects HTTP to HTTPS.

Steps and menu labels follow Plesk Obsidian with the SSL It! extension as of November 2026; labels may differ slightly between versions.

Prerequisites

Let's Encrypt must be able to validate the domain.

• A Plesk Obsidian subscription with access to Websites & Domains.
• DNS A/AAAA records for example.com and www.example.com pointing at the Plesk server, for example 203.0.113.10.
• Port 80 reachable from the internet for HTTP validation, or Plesk managing the DNS zone for DNS validation and wildcards.
• The SSL It! extension installed (it is included in current Plesk installations).

Step 1: Open SSL It! for the domain

Go to Websites & Domains, select example.com, and click SSL/TLS Certificates. The SSL It! page shows the current certificate status for the domain, www, webmail and mail.

Step 2: Get the free certificate

Click Install under the free basic certificate option, then choose what to secure:

• Secure the domain name and Include a "www" subdomain.
• Secure webmail and Assign the certificate to mail domain if you use Plesk mail.
• Secure the wildcard domain only if Plesk is the primary DNS for the domain.

Enter an email address if requested and click Get it free. Plesk validates the domain and installs the certificate.

Step 3: Turn on redirect, HSTS and "Keep websites secured"

Three switches on the same SSL It! page control the redirect, HSTS and automatic reissue:

• Switch on Redirect from HTTP to HTTPS (a 301 redirect).
• Switch on HSTS only after reading enable HSTS.
• Switch on Keep websites secured so new subdomains, aliases and webmail are added to the certificate automatically.

Step 4 (optional): Install a purchased certificate

To use a commercial certificate, use the Upload or Install options for a paid certificate in SSL It!, paste the certificate, private key and CA certificate (intermediate), and assign it to the domain. Paste the intermediate so the chain is complete.

Verify

The domain should present a Let's Encrypt certificate, and HTTP should return a 301 redirect to HTTPS. Check it with the SSL checker, or from any terminal:

curl ssl.sh/example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'

The HSTS checker confirms the HSTS header if you enabled it.

Automatic renewal

SSL It! renews free Let's Encrypt certificates 30 days before they expire, with no cron job to manage. Validation must keep working: if DNS moves to a CDN or port 80 is closed later, renewals fail; in that case use DNS validation (available in recent SSL It! versions). Because Let's Encrypt's default lifetime drops to 64 days on February 10, 2027 and 45 days on February 16, 2028, check the SSL It! change log for how its renewal window adapts, and add the domain to ssl.sh monitoring (in development) as an independent check.

Troubleshooting

• Let's Encrypt could not validate the domain: DNS does not point to this server or port 80 is blocked; the causes match certbot timeout during connect.
• CAA record prevents issuance: a CAA record excludes Let's Encrypt; see CAA record prevents issuance.
• Wildcard option missing: the domain's DNS is not managed by Plesk.
• Rate limit reached: repeated reissues for the same names; see Let's Encrypt rate limits.
• Mail clients show the wrong certificate: the certificate was not assigned to mail; enable Assign the certificate to mail domain.