SSL certificates
Get and renew a Let's Encrypt certificate for FeatherPanel with the installer's SSL menu, by HTTP or DNS challenge, and set up automatic renewal.
On this page
The panel containers do not handle TLS. Your reverse proxy does, with a certificate in /etc/letsencrypt/live/<domain>/,
which is the path the nginx and Apache templates expect.
Caddy and a Cloudflare Tunnel handle certificates
themselves.
The SSL menu
Run the installer and pick [4] SSL:
| Option | What it does |
|---|---|
| Install Certbot | Installs certbot and the nginx or Apache plugin |
| Create Certificate (HTTP) | certbot certonly with the --nginx, --apache or --standalone authenticator |
| Create Certificate (DNS) | certbot certonly --manual --preferred-challenges dns: you add the TXT record by hand |
| Setup Auto-Renewal | Adds the renewal cron job below |
| Install acme.sh | Installs acme.sh for DNS API challenges such as acme.sh --issue --dns dns_cf -d yourdomain.com |
The installer registers certificates with admin@<your domain> as the contact address. If that mailbox does not exist,
update it afterwards with certbot update_account --email [email protected].
HTTP challenge
The domain must resolve to the server and port 80 must be open. With the nginx or Apache authenticator, Certbot uses the running web server. The standalone authenticator starts its own server on port 80, so the installer stops nginx first and starts it again afterwards.
sudo certbot certonly --nginx -d panel.example.comDNS challenge
Use it when port 80 is closed or the server is behind NAT. Certbot prints a TXT record for _acme-challenge.<domain>. Add
it at your DNS provider, wait until it resolves, then confirm.
sudo certbot certonly --manual --preferred-challenges dns -d panel.example.comManual DNS certificates do not renew on their own, because each renewal needs a new TXT record. Use acme.sh with your DNS provider’s API if you want unattended renewals.
Renewal
Setup Auto-Renewal writes this root crontab entry, with the restart command for the web server it detects:
0 23 * * * certbot renew --quiet --deploy-hook "systemctl restart nginx"On a Wings-only node the hook restarts featherwings instead, so the daemon loads the new certificate. Test renewal
without changing anything:
sudo certbot renew --dry-runFrequently asked questions
The installer's Setup Auto-Renewal option adds a root cron job that runs certbot renew --quiet every day at 23:00 and restarts nginx, Apache or FeatherWings after a renewal. Without it, renewal depends on the certbot package's own timer.
No. Cloudflare terminates TLS for tunnel hostnames, so the server needs no certificate for the panel.