# SSL certificates

> Get and renew a Let's Encrypt certificate for FeatherPanel with the installer's SSL menu, by HTTP or DNS challenge, and set up automatic renewal.

Source: https://featherpanel.com/docs/panel/ssl/

The panel containers do not handle TLS. Your reverse proxy does, with a certificate in `/etc/letsencrypt/live/<domain>/`,
which is the path the [nginx](https://featherpanel.com/docs/panel/web-server/nginx) and [Apache](https://featherpanel.com/docs/panel/web-server/apache) templates expect.
[Caddy](https://featherpanel.com/docs/panel/web-server/caddy) and a [Cloudflare Tunnel](https://featherpanel.com/docs/panel/web-server/cloudflare-tunnel) handle certificates
themselves.

## The SSL menu

Run the installer and pick `[4] SSL`:

| Option | What it does |
|--------|--------------|
| Install Certbot | Installs `certbot` and the nginx or Apache plugin |
| Create Certificate (HTTP) | `certbot certonly` with the `--nginx`, `--apache` or `--standalone` authenticator |
| Create Certificate (DNS) | `certbot certonly --manual --preferred-challenges dns`: you add the TXT record by hand |
| Setup Auto-Renewal | Adds the renewal cron job below |
| Install acme.sh | Installs acme.sh for DNS API challenges such as `acme.sh --issue --dns dns_cf -d yourdomain.com` |

The installer registers certificates with `admin@<your domain>` as the contact address. If that mailbox does not exist,
update it afterwards with `certbot update_account --email you@example.com`.

## HTTP challenge

The domain must resolve to the server and port 80 must be open. With the nginx or Apache authenticator, Certbot uses the
running web server. The standalone authenticator starts its own server on port 80, so the installer stops nginx first and
starts it again afterwards.

```bash
sudo certbot certonly --nginx -d panel.example.com
```

## DNS challenge

Use it when port 80 is closed or the server is behind NAT. Certbot prints a TXT record for `_acme-challenge.<domain>`. Add
it at your DNS provider, wait until it resolves, then confirm.

```bash
sudo certbot certonly --manual --preferred-challenges dns -d panel.example.com
```

Manual DNS certificates do not renew on their own, because each renewal needs a new TXT record. Use acme.sh with your DNS
provider's API if you want unattended renewals.

## Renewal

`Setup Auto-Renewal` writes this root crontab entry, with the restart command for the web server it detects:

```cron
0 23 * * * certbot renew --quiet --deploy-hook "systemctl restart nginx"
```

On a Wings-only node the hook restarts `featherwings` instead, so the daemon loads the new certificate. Test renewal
without changing anything:

```bash
sudo certbot renew --dry-run
```

## Frequently asked questions

### Does FeatherPanel renew certificates automatically?

The installer's Setup Auto-Renewal option adds a root cron job that runs certbot renew --quiet every day at 23:00 and restarts nginx, Apache or FeatherWings after a renewal. Without it, renewal depends on the certbot package's own timer.

### Do I need a certificate with a Cloudflare Tunnel?

No. Cloudflare terminates TLS for tunnel hostnames, so the server needs no certificate for the panel.