Install Let’s Encrypt SSL in Virtualmin

This guide walks you through installing a free Let’s Encrypt SSL certificate on your Virtualmin-managed server, covering both the automatic and manual methods. By the end, your websites will be served over HTTPS with a trusted certificate, and you’ll know how to renew it automatically.

What You’ll Need

• A server running Virtualmin (any modern version, including the GPL and Pro editions).
• Root or sudo access to the server’s command line (via SSH).
• A domain name that resolves (A/AAAA record) to your server’s public IP address.
• Port 80 and 443 open in your firewall (Let’s Encrypt uses HTTP-01 or TLS-ALPN-01 challenges).
• If you use a CDN or reverse proxy, make sure it forwards the ACME challenge correctly, or temporarily bypass it.

Step-by-Step

1. Log into Virtualmin as root (or a user with full administrative privileges) via the web interface.
2. Go to the virtual server you want to secure by clicking its name in the left sidebar under “Virtual Servers”.
3. Open the “Manage SSL Certificate” page: in the left menu, expand “Services” and click “Manage SSL Certificate”. This page shows the current certificate, key, and signing request.
4. Click the “Let’s Encrypt” tab at the top of the certificate management page. If you don’t see this tab, your Virtualmin version may be older; update it or use the command-line method below.
5. Select the domains to include: check the box for the main domain and any subdomains (like www) that you want covered. Virtualmin automatically lists the domain aliases.
6. Choose the validation method: usually “Web” (HTTP-01) is fine. If you have a firewall blocking port 80, you may need to use “DNS” validation, but that requires you to create a TXT record manually (see Troubleshooting).
7. Enable automatic renewal: check the box that says “Automatically renew this certificate” (or similar). This creates a cron job that renews the certificate before it expires.
8. Click “Request Certificate”. Virtualmin will contact Let’s Encrypt, perform the challenge, and install the certificate. Wait a few seconds.
9. Verify the result: the page should show a success message with the certificate details (issuer, expiry date). You can also test by visiting https://yourdomain.com in a browser—look for the padlock icon.
10. Force HTTPS redirection (optional but recommended): go to “Server Configuration” → “Website Options” and check “Redirect HTTP to HTTPS”. This ensures all visitors use the secure version.

If your Virtualmin lacks the Let’s Encrypt tab (older versions), use the command-line method:

1. SSH into your server as root.
2. Install Certbot if not already installed: apt install certbot (Debian/Ubuntu) or yum install certbot (RHEL/CentOS).
3. Run Certbot with the Webroot plugin, specifying the web root of your virtual server (usually /home/yourdomain/public_html):
   certbot certonly --webroot -w /home/yourdomain/public_html -d yourdomain.com -d www.yourdomain.com
4. Follow the prompts to agree to the terms and enter your email for expiry notifications.
5. Install the certificate into Virtualmin: go back to the “Manage SSL Certificate” page, click “Paste a certificate and key”, and copy the contents of /etc/letsencrypt/live/yourdomain.com/fullchain.pem and privkey.pem into the respective fields.
6. Set up auto-renewal: add a cron job that runs certbot renew --quiet twice a day (or use a systemd timer). After renewal, you must also reload Apache/Nginx—Virtualmin usually does this automatically if you use its own renewal script.

Common Mistakes

• Forgetting to include the www subdomain—get a certificate for both the bare domain and www, otherwise visitors get a security warning.
• Using the wrong web root in the webroot method—if the path is wrong, the challenge fails. Double-check the actual document root in Virtualmin.
• Firewall blocking port 80—Let’s Encrypt needs to reach your server on port 80 (or 443) to validate. Ensure your firewall allows it.
• Not enabling auto-renewal—Let’s Encrypt certificates expire every 90 days. Without renewal, your site will show an error.
• Attempting to install a certificate on a domain that doesn’t point to your server—the validation will fail because Let’s Encrypt can’t reach your server.

Tips

• Use the Virtualmin built-in method whenever possible—it handles renewal and installation automatically, and it’s less error-prone.
• Set up a reminder for certificate expiry (e.g., a calendar alert) as a backup, even with auto-renewal.
• Test HTTPS after installation using an online SSL checker or openssl s_client -connect yourdomain.com:443 to verify the certificate chain is correct.
• If you have multiple domains on the same server, you can request a single certificate covering all of them (SAN certificate) in one go, but Virtualmin’s per-server approach is simpler for management.
• Keep your server’s date/time accurate (NTP) because certificate validation and renewal rely on correct timestamps.

Troubleshooting

• “Failed to connect to 80 port” error: Check your firewall (ufw, iptables) and your cloud provider’s security group. Temporarily disable the firewall to test, then re-enable with the correct rules.
• “Invalid response from http://domain/.well-known/acme-challenge/…”: This usually means the web root is wrong or a redirect is interfering. Ensure the web root contains the challenge file temporarily (check with curl http://domain/.well-known/acme-challenge/test). Also, disable any HTTP-to-HTTPS redirect during the challenge.
• “DNS problem: NXDOMAIN”: Your domain’s DNS doesn’t resolve to your server. Update the A record at your DNS provider and wait for propagation (can take up to 48 hours, but usually minutes).
• Certificate installed but browser shows “Not Secure”: Check that the certificate is for the exact domain you’re visiting (including www). Also, ensure the site is loading over HTTPS (not mixed content).
• Renewal fails with “Rate limit exceeded”: Let’s Encrypt has rate limits. If you’ve requested too many certificates for the same domain in a short time, wait a week. Avoid repeated manual requests.
• Virtualmin says “Certificate not found” after manual install: Make sure you pasted the full chain (fullchain.pem) and the private key correctly, with no extra spaces or line breaks.

Frequently Asked Questions

Is Let’s Encrypt really free?

Yes, Let’s Encrypt is a free, automated, and open certificate authority. There are no costs for issuing or renewing certificates.

How often do Let’s Encrypt certificates expire?

They expire after 90 days. Virtualmin’s automatic renewal runs usually twice a day, so you don’t need to worry about manual renewals.

Can I use Let’s Encrypt for a subdomain like mail.example.com?

Yes, you can include any subdomain that resolves to your server. In Virtualmin, you can add subdomains to the certificate request or create a separate virtual server for them.

Will installing Let’s Encrypt affect my existing SSL certificate?

No, it will replace it. If you have a paid certificate, you can keep it as a backup, but the Let’s Encrypt one will be used for HTTPS.

Do I need to install anything on my server?

Virtualmin includes the necessary client (certbot) by default in recent versions. If not, you can install it via your package manager.

What if my domain uses a CDN like Cloudflare?

If you use a CDN, the ACME challenge may be blocked. Either temporarily set DNS to “DNS only” (grey cloud) during issuance, or use DNS validation in Virtualmin (requires manual TXT record). After issuance, you can re-enable the CDN proxy.

Related

• AI Self-Regulation: Can Voluntary Pledges Protect Frontier Systems?
• GTA 6 vs GTA 5: Open World Changes
• SteelSeries Arctis Nova Pro vs Aeon Pro: Which Fits?