Mist Network
Free SSL Certificate in Plesk: Let's Encrypt Setup Step by Step
Plesk can issue and renew free Let's Encrypt certificates in a few clicks. Here is what has to be in place first, how to secure every subdomain and how to fix the errors people hit most.
A free SSL certificate in Plesk takes a few clicks: Plesk talks to Let's Encrypt, proves you control the domain, installs the certificate and renews it automatically before it expires. Once it is in place your site loads over HTTPS, browsers stop showing "Not secure" warnings and you can safely accept logins and payments.
This guide covers what must be ready before you start, the exact steps in Plesk, how to secure subdomains with a wildcard certificate, how to force HTTPS correctly and how to fix the errors that stop issuance or renewal.
What an SSL certificate does
An SSL/TLS certificate lets a browser verify that it is talking to your server and encrypts everything sent between them. Without it, passwords, form data and cookies travel in plain text, browsers flag the page as insecure and some features, such as HTTP/2 and many modern browser APIs, are unavailable.
Let's Encrypt is a free, automated certificate authority trusted by all major browsers. Its domain-validated certificates encrypt traffic exactly as well as paid ones. Paid certificates mainly add organisation validation or warranties, which most websites do not need.
Before you start: requirements
- The domain points to your hosting — the A record (and AAAA, if you use IPv6) for the domain and for www must resolve to your Plesk server's IP.
- DNS has propagated — if you just changed records, wait until they resolve worldwide. Our guide on DNS record types explains A, AAAA and CAA records.
- Port 80 is reachable — Let's Encrypt checks a file over plain HTTP during validation, so do not block port 80.
- No conflicting CAA record — if your domain has CAA records, one of them must allow letsencrypt.org.
- A working email address — used for the account with the certificate authority.
How to install a free SSL certificate in Plesk
Recent Plesk versions handle certificates through the SSL It! extension, which uses Let's Encrypt by default. The menu names below may differ slightly between Plesk versions.
- Open the website — log in to Plesk, go to Websites & Domains and select the domain.
- Open SSL/TLS Certificates — click SSL/TLS Certificates (or SSL It!) on the domain's dashboard.
- Choose Let's Encrypt — select the free Let's Encrypt option and enter your email address.
- Select what to secure — tick the main domain and the www subdomain; add webmail or mail if you use them.
- Issue the certificate — click Get it free or Install. Plesk validates the domain and installs the certificate within seconds.
- Enable the HTTPS redirect — turn on the permanent SEO-safe 301 redirect from HTTP to HTTPS in the same screen or in Hosting Settings.
- Check it — open https://yourdomain in a browser and confirm the padlock appears without warnings.
Wildcard certificates for subdomains
If you run many subdomains, a wildcard certificate such as *.example.com covers all of them at once. Wildcards are validated through DNS rather than HTTP: the certificate authority asks for a special TXT record under _acme-challenge.
| Where your DNS is hosted | How wildcard validation works | Renewal |
|---|---|---|
| Plesk manages the DNS zone | Plesk creates the TXT record itself | Fully automatic |
| External DNS (for example Cloudflare) | You add the TXT record that Plesk shows | May need the record updated at renewal |
| No wildcard needed | Normal HTTP validation per subdomain | Fully automatic |
If you only have a few subdomains, issuing a normal certificate that lists each one is usually simpler and renews without manual DNS work.
Forcing HTTPS the right way
Once the certificate works, make HTTPS the only version of your site:
- Use one 301 redirect — redirect HTTP to HTTPS at the server level in Plesk instead of stacking plugin redirects, which can cause loops.
- Update the site URL — in WordPress or your CMS, set the site address to https:// so links and canonical tags are correct.
- Fix mixed content — images, scripts or fonts loaded over http:// break the padlock. Update hard-coded URLs in the database or theme.
- Consider HSTS — HTTP Strict Transport Security tells browsers to always use HTTPS. Enable it only after everything works, because it is hard to undo.
Common errors and how to fix them
- Domain validation failed — the domain or www does not point to this server yet, or DNS has not propagated. Check the A records and try again later.
- Too many requests / rate limit — repeated failed attempts hit Let's Encrypt limits. Fix the cause, then wait before retrying.
- CAA record prevents issuance — add a CAA record that allows letsencrypt.org, or remove conflicting CAA records.
- Validation file not reachable — a custom rule in .htaccess, a firewall or a forced redirect blocks the /.well-known/acme-challenge/ path. Allow it.
- Renewal failed — usually the same causes as above, appearing after a DNS or server change. Plesk renews well before expiry, so you have time to fix it.
SSL on mistREG Plesk hosting
mistREG hosting accounts run Plesk on LiteSpeed, set up automatically about 60 seconds after payment, with free Let's Encrypt certificates available in the panel. Domains registered here use DNS hosted on Cloudflare's network, so pointing the domain to your hosting and adding a CAA record happen in the same panel. Read more in our guide to Plesk hosting with LiteSpeed.
Ready to secure your site? Create an account, pick a plan on the plans section and issue your certificate in minutes. Our team helps on Telegram at @mistnetwork.
