📌 Purpose & Quick Summary
Security and SEO demand encrypted HTTPS connections. The SSL/TLS Security center provides 1-click automated issuance of free Let's Encrypt SSL certificates. It features intelligent Pointed Only pre-validation (preventing rate limit lockouts), automated 90-day background renewal crons, and 1-click Enforce HTTPS Redirection across all domains and subdomains.
Figure 18: SSL/TLS Manager showing Let's Encrypt AutoSSL status, pointed domain filter, and HTTPS enforcement.
🖥️ Interface Tour & Elements
- Tabs Navigation: Automated Let's Encrypt (AutoSSL) and Manual Custom SSL.
- Pointed Only Filter: Toggle button that filters out unpropagated domains, ensuring Let's Encrypt issuance only fires for domains whose DNS A record already resolves to this server.
- AutoSSL Domain Ledger Table: Displays Domain Name, Certificate Issuer (
Let's Encrypt Authority), Expiration Date, Status badge (Active), Issue / Renew SSL button, and Force HTTPS toggle switch.
🛠️ Step-by-Step Instructions
Step 1: Issuing a Free Let's Encrypt Certificate
- In the sidebar, click SSL/TLS Status (icon:
fa-lock). - Locate your domain in the ledger table.
- Ensure the DNS Pointed indicator is green.
- Click the Issue SSL (or Renew) button.
- The backend initiates an ACME HTTP-01 challenge, verifies domain ownership, installs the certificate, and reloads Nginx in ~5 seconds.
Step 2: Enforcing HTTPS Redirection
- In the domain's row, locate the Force HTTPS toggle switch.
- Switch it to ON.
- All incoming insecure HTTP traffic (
http://) is now permanently redirected (301 Moved Permanently) to encrypted HTTPS (https://) at the edge Nginx level.
⚙️ Complete Field & Parameter Reference Table
| SSL Setting / Status | Value | Operational Implication |
|---|---|---|
| Pointed Only Filter | Toggle | Shields account against Let's Encrypt 5-failure weekly lockout rate limits. |
| Issuer | Let's Encrypt |
Recognized by 99.9% of modern web browsers and mobile operating systems. |
| Auto-Renewal | Automated background cron | Re-checks certificate validity daily and renews 30 days prior to expiration. |
| Force HTTPS | Toggle switch | Injects edge Nginx rewrite rules: return 301 https://$host$request_uri;. |
❓ Troubleshooting & Common Errors
1. Error: "ACME Challenge Failed / 404 Not Found"
- Cause: Domain's DNS A record points to Cloudflare (with proxy orange cloud ON) or another server, preventing HTTP-01 verification.
- Solution: In Cloudflare, temporarily switch SSL to "Full (Strict)" or disable the orange cloud proxy to grey cloud (DNS only) during certificate issuance.
