SSL Certificates

Local Panel documentation · Features

Every website you host should be served over HTTPS. An SSL certificate is what turns a plain http:// address into an encrypted https:// one, and it tells visitors that your site is the site they meant to reach. An ssl certificate and nginx working together is mostly a question of trust, not complexity: you prove that you control the domain, a certificate authority vouches for you, and browsers show the padlock. Local Panel keeps the whole routine in one place.

Before you start

Two things must be true before a certificate can be issued:

• DNS is pointing at your server. The domain's A record must resolve to the server's IP address. If the record was created recently, allow time for it to propagate.
• Port 80 is reachable. Certificate authorities prove domain control by connecting back to your server over port 80. If a firewall or your host's security group blocks it, validation will fail.

You can check both from the terminal in Local Panel:

dig +short example.com A

Issuing a certificate for a website

Once your server is connected in Local Panel (see the quick start guide if it is not), open the website you want to secure and choose the option to issue an SSL certificate. Local Panel asks a certificate authority to validate the domain and, once validation passes, installs the certificate on your server in the standard certificate directory.

The process is automatic and normally takes less than a minute. You do not need to generate keys by hand or copy files around.

How renewal works

Certificates are deliberately short-lived. Treating a certificate as a one-off job is the most common way websites end up with a broken padlock and a browser warning. Renewal has to happen on its own, in the background, before the current certificate expires.

Local Panel handles this for you: issued certificates are renewed automatically, so a website that worked last month keeps working next month. If you prefer to manage certificates yourself outside Local Panel, make sure whatever renews them also reloads nginx afterwards, otherwise the web server keeps serving the old file.

Pointing nginx at the certificate

Issuing the certificate is only half the job. Your nginx server block has to reference the certificate files explicitly, with ssl_certificate for the full chain and ssl_certificate_key for the private key:

server {
    listen 443 ssl;
    server_name example.com;

    ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
}

Local Panel's nginx tools will do this for you when you configure the nginx server block, but it helps to know where the paths live. After any change, test the configuration and reload:

sudo nginx -t && sudo systemctl reload nginx

Troubleshooting

The DNS has not propagated yet

If validation fails immediately after you created the record, wait and try again. Check what the rest of the internet sees with dig +short example.com A rather than trusting your local resolver.

Port 80 is blocked

A host-level firewall or your provider's security group may be dropping port 80. On a server using ufw, allow it with:

sudo ufw allow 80/tcp

The server name does not match

The server_name in the nginx block must exactly match the domain you requested the certificate for. A certificate for www.example.com will not cover example.com, and vice versa. Request a certificate for each name you serve, or make sure the block lists them all.

Next steps

With HTTPS in place you can deploy a PHP website and serve it over a proper secure connection. If something above did not solve your problem, our nginx configuration guide goes deeper into server blocks and virtual hosts.

Still stuck? Email contact@nesdzo.co.uk — we're happy to help.