How to Install a Free SSL Certificate in Plesk (Let's Encrypt)

Every site should load over HTTPS. Browsers mark plain HTTP pages as "Not secure", Google uses HTTPS as a ranking signal, and a certificate from Let's Encrypt costs nothing. Plesk has the whole flow built in, so there is no command line needed for the basic case — but we will cover that too, for when you want to script it.

Before you start

You need two things in place:

• The domain's A record (and www if you use it) must already point at your Plesk server. Let's Encrypt validates by fetching a file from your site, so DNS has to resolve first.
• Port 80 must be reachable. If you have moved everything to 443 with a firewall rule, open 80 for the validation.

Check DNS from your own machine:

dig +short example.com A
dig +short www.example.com A

Both should print your server's IP. If they don't, wait for propagation before going further — the request will simply fail otherwise.

Issue the certificate from the panel

1. In Plesk, open Websites & Domains and pick the domain.
2. Click SSL/TLS Certificates.
3. Under Install a free basic certificate provided by Let's Encrypt, click Install.
4. Enter an email address for expiry notices, then tick:
   • Secure the domain name — the site itself.
   • Include a "www" subdomain — unless you have deliberately never used www.
   • Secure webmail and Assign the certificate to mail domain — so your mail client stops warning about mail.example.com.
5. Click Get it free.

Plesk requests the certificate, installs it, and switches the site's vhost to it. Reload the domain in a browser: you should see the padlock.

Wildcard certificates

If you run many subdomains (shop.example.com, app.example.com), issue a wildcard instead so you never do this again per subdomain. Tick Secure wildcard domain (including www). This uses DNS validation: Plesk shows a _acme-challenge TXT record to add at your DNS provider. Add it, wait a minute, then click Continue. Verify the record is visible before continuing:

dig +short TXT _acme-challenge.example.com

Force HTTPS

A certificate does not redirect anyone by itself. Under Hosting & DNS → Hosting Settings, tick Permanent SEO-safe 301 redirect from HTTP to HTTPS. This is the setting that stops search engines seeing two copies of your site.

If you prefer to control it in the site itself, an .htaccess rule does the same:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

From the command line

The same operation, scriptable — handy when you set up many domains:

plesk bin extension --exec letsencrypt cli.php \
  -d example.com -d www.example.com \
  -m you@example.com --secure-mail

To list every certificate on the server with its expiry:

plesk bin certificate --list -domain example.com

Renewal

Let's Encrypt certificates last 90 days. Plesk's SSL It! extension renews them automatically about 30 days before expiry — there is nothing to schedule. The one thing that breaks renewal is the same thing that breaks issuing: DNS moved away, or port 80 closed. If you get an expiry email, that is where to look.

Common errors

On VPSPioneer shared and reseller plans this is already done for every new domain — the certificate is issued at account creation and renewed for you. On a managed VPS we set it up as part of the handover.

#plesk#ssl#lets-encrypt#https