Associating Your Domain

Associating Your Domain

Overview

This page does two things at once: it puts your own domain on the server, and it replaces the control panel’s certificate warning with a trusted Let’s Encrypt certificate. The same certificate also moves your mail and FTP services across.

The order matters. The control panel cannot be given a trusted certificate until a domain exists on the server, so the website comes first and the panel follows.

Before you begin: Point your domain’s DNS A record at your instance’s public IP address, and allow it to propagate. Let’s Encrypt verifies the domain over the public internet, so it must resolve to this server before you start. Your instance should be on an Elastic IP, or the address will change and the certificate will stop renewing.

Step 1: Add the website

• In the control panel, go to Sites > Add New Website.
• Enter your domain in the Domain field, for example ispconfig.example.com.

Step 2: Tick both SSL boxes together

Tick SSL and Let’s Encrypt SSL together. They are two separate checkboxes and both are required. Ticking only Let’s Encrypt SSL does not issue a certificate, and this is the most common reason the next step reports that no certificate was found.

• Save the website and wait for the certificate to be issued. This usually takes under a minute.
• Confirm it worked by opening https://<your-domain>/ in a browser. It should load without a certificate warning.

Step 3: Move the control panel onto that certificate

• Return to your SSH session and run:

• Use the full path shown above. sudo uses a restricted search path that does not include /usr/local/bin, so the short command name returns “command not found”.

The tool lists the websites on this server that have a Let’s Encrypt certificate, marks the one the control panel is using now, and asks which domain you want. ISPConfig hosts many domains, so this is your choice to make. Type the domain and press Enter. If there is only one, it is offered as the default and Enter accepts it.

You can also name the domain directly, which skips the question:

The tool moves four services onto your certificate in one action: the control panel, Postfix, Dovecot and pure-ftpd. It checks that the panel comes back on the new certificate and puts the previous one back automatically if anything goes wrong, so it will not lock you out of your own panel.

Step 4: Use the new address

After the tool reports Done, your control panel is at:

• The certificate warning is gone, and renewal is automatic. Nothing further is needed.
• Continue to sign in with the username admin and the password from the installation summary.

Which address do I use?

After adding a website there are two different addresses and it is worth being clear about which is which.

Things to know afterwards

• Keep that website in place. The control panel, mail and FTP all use its certificate. Deleting the website removes the certificate those services depend on and breaks all three at once.
• Adding more websites changes nothing. Each new site gets its own certificate, and the control panel stays on the domain you chose. Adding a second site does not move the panel and does not need any action.
• To move the panel to a different domain later, add that website first with both SSL boxes ticked, then run the command again and choose the new domain when it asks. The list shows which one the panel is on now, so you can see what you are changing from.

• Keep the Elastic IP. If your public address changes, your domain stops resolving to the server and the certificate stops renewing. Nothing breaks at the moment the address changes, which is what makes it easy to miss: the failure arrives about ninety days later when the certificate expires and the panel, mail and FTP stop together.

If it reports that no certificate was found

The tool reports this when there is no issued Let’s Encrypt certificate on the machine yet. In order of likelihood:

• Only one of the two SSL boxes was ticked. Both are required. Edit the website, tick both, and save again.
• The domain does not yet resolve to this server, so Let’s Encrypt could not verify it.
• Inbound port 80 is closed in the security group. Let’s Encrypt verifies over port 80 even though the result is used on 443.
• The certificate is still being issued. Wait a minute and run the command again.

Need help? Email [email protected].