# Plesk SSL: free Let's Encrypt certificates with SSL It!

> Secure a Plesk Obsidian site with SSL It!: free Let's Encrypt certificate, wildcard via DNS, HTTP-to-HTTPS redirect, HSTS and auto renewal.

Source: https://ssl.sh/guides/plesk-ssl/
Last updated: 2026-11-10

Plesk Obsidian issues free Let's Encrypt certificates through the SSL It! extension. One click on **Get it free** covers the domain, `www` and optionally webmail and mail, and SSL It! renews the certificate on its own. A switch on the same page redirects HTTP to HTTPS.

Steps and menu labels follow Plesk Obsidian with the SSL It! extension as of November 2026; labels may differ slightly between versions.

## Prerequisites

Let's Encrypt must be able to validate the domain.

- A Plesk Obsidian subscription with access to **Websites & Domains**.
- DNS `A`/`AAAA` records for `example.com` and `www.example.com` pointing at the Plesk server, for example `203.0.113.10`.
- Port 80 reachable from the internet for HTTP validation, or Plesk managing the DNS zone for DNS validation and wildcards.
- The SSL It! extension installed (it is included in current Plesk installations).

## Step 1: Open SSL It! for the domain

Go to **Websites & Domains**, select `example.com`, and click **SSL/TLS Certificates**. The SSL It! page shows the current certificate status for the domain, `www`, webmail and mail.

## Step 2: Get the free certificate

Click **Install** under the free basic certificate option, then choose what to secure:

- **Secure the domain name** and **Include a "www" subdomain**.
- **Secure webmail** and **Assign the certificate to mail domain** if you use Plesk mail.
- **Secure the wildcard domain** only if Plesk is the primary DNS for the domain.

Enter an email address if requested and click **Get it free**. Plesk validates the domain and installs the certificate.

## Step 3: Turn on redirect, HSTS and "Keep websites secured"

Three switches on the same SSL It! page control the redirect, HSTS and automatic reissue:

- Switch on **Redirect from HTTP to HTTPS** (a 301 redirect).
- Switch on **HSTS** only after reading [enable HSTS](https://ssl.sh/guides/enable-hsts/).
- Switch on **Keep websites secured** so new subdomains, aliases and webmail are added to the certificate automatically.

## Step 4 (optional): Install a purchased certificate

To use a commercial certificate, use the **Upload** or **Install** options for a paid certificate in SSL It!, paste the certificate, private key and CA certificate (intermediate), and assign it to the domain. Paste the intermediate so the chain is complete.

## Verify

The domain should present a Let's Encrypt certificate, and HTTP should return a 301 redirect to HTTPS. Check it with the [SSL checker](https://ssl.sh/tools/ssl-checker/), or from any terminal:

```bash
curl ssl.sh/example.com
curl -sI http://example.com | grep -iE '^(HTTP|location)'
```

The [HSTS checker](https://ssl.sh/tools/hsts-checker/) confirms the HSTS header if you enabled it.

## Automatic renewal

SSL It! renews free Let's Encrypt certificates 30 days before they expire, with no cron job to manage. Validation must keep working: if DNS moves to a CDN or port 80 is closed later, renewals fail; in that case use DNS validation (available in recent SSL It! versions). Because Let's Encrypt's default lifetime drops to 64 days on February 10, 2027 and 45 days on February 16, 2028, check the SSL It! change log for how its renewal window adapts, and add the domain to [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) as an independent check.

## Troubleshooting

- **Let's Encrypt could not validate the domain**: DNS does not point to this server or port 80 is blocked; the causes match [certbot timeout during connect](https://ssl.sh/errors/certbot-timeout-during-connect/).
- **CAA record prevents issuance**: a CAA record excludes Let's Encrypt; see [CAA record prevents issuance](https://ssl.sh/errors/caa-record-prevents-issuance/).
- **Wildcard option missing**: the domain's DNS is not managed by Plesk.
- **Rate limit reached**: repeated reissues for the same names; see [Let's Encrypt rate limits](https://ssl.sh/errors/lets-encrypt-rate-limit/).
- **Mail clients show the wrong certificate**: the certificate was not assigned to mail; enable **Assign the certificate to mail domain**.