aaPanel: manage SSL, databases and FTP from the panel

An aaPanel SSL certificate takes about a minute to issue once your domain points at the server, and the same panel handles databases and FTP accounts without you opening a terminal. This guide covers the three tasks you will repeat most often on a new site: securing it with Let's Encrypt, creating a MySQL database and user, and adding an FTP account for a colleague or a deployment script.

Before you start

• A Linux VPS with aaPanel installed and reachable on its panel port (8888 by default). If you have not installed it yet, the installer is a single shell command — check the aaPanel site for the current one, because it changes from time to time:

URL=https://www.aapanel.com/script/install_6.0_en.sh && curl -ksSO "$URL" && bash install_6.0_en.sh aapanel

• SSH access to the server. If this is your first time, see Connect to your Linux VPS with SSH.
• A domain with an A record pointing at your server IP. The examples use 203.0.113.10 and example.com.
• Panel login details. If you lost them, run bt default over SSH.
• These ports open on the server and at your provider: 8888 for the panel, 80 and 443 for websites, 21 plus the passive range 39000-40000 for FTP.

Log in and open the ports aaPanel needs

1. Open http://203.0.113.10:8888 (or your security entrance URL) and log in.
2. If the login page does not load, check the firewall on the server and at your provider:

sudo ufw status
sudo ufw allow 8888/tcp
sudo ufw allow 80,443/tcp
sudo ufw allow 21/tcp
sudo ufw allow 39000:40000/tcp

1. Confirm the panel service is running and print its details:

bt default

That shows the panel address, username and password. The bt command also opens an interactive menu for restarting services, changing the port and resetting the password.

Issue an aaPanel SSL certificate with Let's Encrypt

1. Go to Website, find your site, and open its settings. Choose SSL in the left column, then the Let's Encrypt tab.
2. Tick every domain you want on the certificate. Both example.com and www.example.com should already resolve to 203.0.113.10 before you continue.
3. Pick the validation method. HTTP file validation is the simplest and works when port 80 is reachable. DNS validation is the right choice when the domain sits behind a proxy such as Cloudflare or the site is not serving on port 80 yet.
4. Click Apply. aaPanel asks the ACME server for the certificate, writes the files, and reloads Nginx or Apache. Expect 10 to 60 seconds.
5. Switch on Force HTTPS so plain HTTP requests redirect to the secure version.

Renewal is handled by a cron task that aaPanel creates for you. Open Cron and confirm a certificate renewal job exists. If you used DNS validation, the DNS API key has to stay valid, otherwise the renewal will fail silently.

Create a database and a database user

1. Open Database and click Add database.
2. Fill in the fields: database name appdb, username appuser, a generated password, and the access permission. Use localhost for an application on the same server. Use % only when something outside the server must connect, and pair it with a firewall rule.
3. Save. aaPanel creates the database and the user and grants the privileges in one step.
4. Click phpMyAdmin in the database list to import a dump or run queries in the browser.

To import from the command line instead:

mysql -u appuser -p appdb < /home/deploy/appdb.sql

Then confirm the credentials work and the user sees only what it should:

mysql -u appuser -p -e "SHOW DATABASES;"

Create an FTP account

1. Open FTP and click Add FTP.
2. Set the username to deploy, generate a password, and set the path. Point it at the site root, /www/wwwroot/example.com, so the account cannot wander into other sites on the server.
3. Set a quota if you want to cap uploads, then save.
4. Connect from your own machine:

ftp 203.0.113.10

Or use a GUI client with host 203.0.113.10, port 21, and the user deploy.

If the login succeeds but the directory listing hangs, passive mode is being blocked. Open TCP 39000-40000 on the server and at your provider.

Check it works

• https://example.com loads with a padlock and http://example.com redirects to it.
• curl -I https://example.com returns a 200 and a valid certificate chain.
• The database user connects and can see its own database only.
• The FTP account lists files in the site directory and cannot reach /etc or another site's folder.

Troubleshooting

• Let's Encrypt fails with "DNS problem: NXDOMAIN" — the A record is missing or still propagating. Check with dig +short example.com and wait out the TTL.
• The certificate was issued but the browser still shows the old one — the web server was not reloaded, or a CDN is caching the old certificate. Reload Nginx or Apache from the panel, then purge the CDN cache.
• "Access denied for user 'appuser'@'localhost'" — the password is wrong, or the user was created with host % while the application connects to 127.0.0.1. Recreate the user with the host that matches the connection.
• FTP login times out — port 21 is blocked, or the passive range 39000-40000 is closed. Open both on the server and at your provider.
• The panel is unreachable after a firewall change — you locked yourself out of port 8888. Use your provider's console to run sudo ufw allow 8888/tcp.

Next steps

• Secure Nginx with a free Let's Encrypt SSL certificate for the command-line equivalent of the panel workflow.
• Protect SSH from brute-force attacks with Fail2ban before you hand out more accounts.
• Check your VPS CPU, RAM and disk from the command line to confirm the server has room for the sites you are adding.