Secure a domain with SSL It! and Let's Encrypt in Plesk

SSL It! is the Plesk extension that issues, installs and renews SSL/TLS certificates. Combined with Let's Encrypt it gives every domain free HTTPS that renews itself. This guide shows how to secure a domain, its www alias and webmail, and how to fix the most common validation errors.

Before you start

• The domain's DNS A (and AAAA, if used) records must point to your Plesk server. Let's Encrypt checks this over the internet.
• The SSL It! and Let's Encrypt extensions are installed (they are by default on Plesk Obsidian). Admins can check under Extensions → My Extensions.
• Port 80 must be reachable from the internet for HTTP validation.

Issue a Let's Encrypt certificate

1. Log in to Plesk and go to Websites & Domains.
2. Under your domain, click SSL/TLS Certificates. This opens SSL It!.
3. Click Install under Install a free basic certificate provided by Let's Encrypt (or Get it free).
4. Enter an email address for renewal notices.
5. Choose what to secure:
   • Include a "www" subdomain for the domain and each selected alias – leave this ticked.
   • Secure webmail on this domain – tick it so webmail.example.com gets HTTPS.
   • Assign the certificate to the mail domain – lets email clients use your own hostname with SSL.
   • Secure the wildcard domain – only if you need *.example.com; this requires DNS validation (see below).
6. Click Get it free and wait for the confirmation.

Turn on HTTPS redirect and HSTS

Back in SSL It!, use the toggles on the domain's page:

• Redirect from http to https – sends all visitors to the secure version with a permanent 301 redirect.
• HSTS – tells browsers to always use HTTPS. Enable it only after HTTPS works for every subdomain you use, because browsers remember it.
• Keep websites secured – an admin-level option that automatically replaces expired or self-signed certificates.
• OCSP Stapling and TLS 1.3 – improve performance and security; safe to enable on current Plesk.

Wildcard certificates

Wildcard certificates need DNS validation. If Plesk manages your DNS zone, SSL It! adds the required _acme-challenge TXT record automatically and renews without help. If your DNS is hosted elsewhere, SSL It! shows a TXT record to create manually, and you must repeat this every renewal. For that reason, prefer a normal certificate with www unless you really need many subdomains.

Check the result

• Open https://yourdomain and click the padlock to confirm the issuer is Let's Encrypt.
• Check that http:// redirects to https://.
• Fix mixed-content warnings by updating hard-coded http:// links in your site or CMS settings.

Renewal

Let's Encrypt certificates last 90 days. Plesk tries to renew them automatically about 30 days before expiry. If renewal fails, Plesk emails the address you entered. Renewal uses the same checks as the first issue, so keep DNS pointing at the server and do not block /.well-known/acme-challenge/ in redirects or security rules.

Troubleshooting

• "Could not issue a Let's Encrypt SSL/TLS certificate" / DNS problem: NXDOMAIN: the domain or www record does not exist publicly. Add the missing record or untick www.
• Invalid response / 404 on challenge: a custom redirect, .htaccess rule or Cloudflare setting intercepts the request. Temporarily disable the rule or set Cloudflare to DNS-only.
• Too many certificates already issued: you hit the Let's Encrypt rate limit. Wait a week, or use fewer test requests.
• Webmail still shows a warning: reissue the certificate with Secure webmail ticked and make sure a webmail DNS record exists.

Next steps

• Manage DNS records in Plesk.
• Set up SPF, DKIM and DMARC in Plesk.
• Harden Plesk with Security Advisor.