Install a free Let's Encrypt SSL certificate in DirectAdmin

DirectAdmin includes Let's Encrypt support, so every domain can have free HTTPS that renews automatically. You can also paste a commercial certificate if you bought one. This guide covers both and the settings that make HTTPS work reliably.

Before you start

• The domain's A record (and www) points to your DirectAdmin server.
• SSL is enabled for your user package. If the SSL menu is missing, ask your reseller or host.

Enable SSL for the domain

1. Log in to DirectAdmin and go to Account Manager → Domain Setup.
2. Click the domain.
3. Make sure Secure SSL is ticked and choose Use a symbolic link from private_html to public_html so HTTP and HTTPS serve the same files.
4. Click Save.

Issue a Let's Encrypt certificate

1. Go to Account Manager → SSL Certificates.
2. Select the domain at the top if you have several.
3. Choose Get automatic certificate from ACME Provider.
4. Set ACME Provider to Let's Encrypt and key type to EC 256 or RSA 2048.
5. Tick the names to include: the domain, www, and mail, ftp or webmail if they exist in DNS. Untick names that do not resolve.
6. Click Save. After a few seconds DirectAdmin confirms the certificate was issued.

Wildcard certificates (*.example.com) are available when DirectAdmin manages your DNS, because they need DNS validation.

Force HTTPS

1. Return to Account Manager → Domain Setup and click the domain.
2. Tick Force SSL with https redirect.
3. Click Save.

Avoid adding a second HTTPS redirect in .htaccess or a plugin; duplicates cause redirect loops.

Install a paid certificate

1. In SSL Certificates, choose Create your own self signed certificate or Create A Certificate Request to generate a CSR and key. Fill in the details and save.
2. Submit the CSR to your certificate authority and complete validation.
3. Back in DirectAdmin, choose Paste a pre-generated certificate and key, paste the certificate and key, and save.
4. Click Click Here to paste a CA Root Certificate, paste the intermediate (CA bundle), tick Use a CA Cert and save.

Renewal

Let's Encrypt certificates last 90 days. DirectAdmin renews them automatically around 30 days before expiry, using the same names. If a name stops resolving (for example you deleted the mail record), renewal fails – reissue without that name.

Troubleshooting

• DNS problem / NXDOMAIN: one of the selected names has no DNS record. Untick it.
• Challenge failed (404 or 403): a redirect, .htaccess rule or CDN intercepts /.well-known/acme-challenge/. Pause the CDN proxy or remove the rule.
• Browser still shows an old certificate: the web server may need a moment to reload; clear the browser cache and test with curl -vI https://example.com.
• Mixed content warnings: update http:// URLs inside your website or CMS settings.

Next steps

• Manage DNS records in DirectAdmin.
• Set up email accounts in DirectAdmin.
• Add domains, subdomains and pointers.