How to install a Let’s Encrypt SSL/TLS certificate on Plesk?

Procédure

This guide explains how to install a free Let’s Encrypt SSL/TLS certificate on a domain from Plesk.
Once installed, the certificate allows your site to be displayed over HTTPS and encrypts exchanges between the visitor’s browser and your site.

An SSL/TLS certificate does not secure the site itself: it does not fix flaws in the code, does not automatically protect a CMS such as WordPress or PrestaShop, and does not guarantee that the site owner is trustworthy.

Let’s Encrypt certificate renewal is automatic. You therefore do not need to renew it manually as long as the domain remains correctly configured.

Before you begin

The domain must point correctly to your Plesk hosting before requesting the certificate.

If you want to install a wildcard certificate, that is, a certificate that also covers subdomains, you must be able to modify the domain’s DNS zone. If the DNS zone is not managed in Plesk or at LWS, the requested record must be added with the provider that manages the domain’s DNS.

Access SSL/TLS certificates in Plesk

1. Log in to Plesk.
2. Select the relevant domain (1) from your site list.
3. In the Dashboard (2) tab, find the Security section.
4. Click SSL/TLS Certificates (3).

If no certificate is installed, Plesk displays a message indicating that the domain is not yet protected.

Install a Let’s Encrypt certificate

1. On the domain’s Let’s Encrypt SSL/TLS Certificate page, click Install in the block Install a basic free certificate provided by Let’s Encrypt.
   
2. A window opens with certificate protection options.
3. Choose the certificate scope according to your needs:

• Secure the domain name: protects the main domain, for example votredomaine.fr.
• Include a "www" subdomain for the domain and each selected alias: also protects www.votredomaine.fr.
• Protect the Wildcard domain: protects the domain and its subdomains, for example blog.votredomaine.fr, boutique.votredomaine.fr or webmail.votredomaine.fr.

4. Click Get it for free.

Validate installation by DNS

Plesk asks you to verify a DNS TXT record.

This step allows Let’s Encrypt to confirm that you really control the domain.

Plesk then displays the information to use, for example:

• Record type: TXT;
• Domain name: _acme-challenge.votredomaine.fr;
• Record: a long value provided by Plesk.

If your DNS zone is managed in Plesk, make sure the requested TXT record is present in Websites & Domains > DNS Settings.

If your DNS zone is managed elsewhere, add the TXT record with the provider that manages the domain’s DNS.

Once the wait is over, return to Plesk then click Continue.

Enable HTTP to HTTPS redirection

Installing the certificate allows the site to work over HTTPS, but it does not always automatically force visitors to use this secure address.

To automatically redirect visitors from http:// to https://:

1. Go back to Websites & Domains > SSL/TLS Certificates.
   
2. In the left column, find the option Redirect from HTTP to HTTPS.
   
3. Turn on the corresponding switch.
4. Then check that your site opens correctly in HTTPS when you enter the address in HTTP.

Enable HSTS

HSTS is an option that tells browsers to always use HTTPS for your domain for a defined period.

This option strengthens HTTPS usage, but it must be enabled with caution.

To enable HSTS:

1. In SSL/TLS Certificates, find the HSTS option in the left column.
   
2. Turn on the HSTS switch.
3. Choose the Max age. The 6 months value is generally recommended.
4. Check Include subdomains only if all your subdomains are properly protected over HTTPS.
   
5. Click Enable HSTS.

Check that the certificate works

After installation, open your site in a browser using the following address:

https://votredomaine.fr

Then check:

• that the site displays correctly;
• that the browser does not display a security warning;
• that Plesk shows the domain as Secured;
• that https://www.votredomaine.fr works if you included www;
• that your subdomains work over HTTPS if you installed a wildcard certificate.

If you enabled HTTP to HTTPS redirection, also test the address:

http://votredomaine.fr

The browser should automatically switch to:

https://votredomaine.fr

Regenerate the certificate

If you want to change the elements protected by the certificate, for example add www or switch from a standard certificate to a wildcard certificate, you must regenerate the certificate.

To do this:

1. Go back to Websites & Domains > SSL/TLS Certificates.
   
2. Click Regenerate the certificate.
   
3. Select the new desired scope.
4. Validate the request.
5. If Plesk asks for DNS validation, add or verify the TXT record, wait about 10 minutes, then click Continue.

Common issues

The certificate does not install and Plesk shows a DNS error

If Plesk shows an error such as DNS problem or NXDOMAIN, this usually means that Let’s Encrypt cannot find the correct DNS pointing for your domain.

Check that:

• the domain points correctly to your Plesk hosting;
• the DNS servers being used are the correct ones;
• the domain’s A or AAAA records exist;
• DNS propagation is complete.

After correcting this, restart the certificate generation.

Plesk asks for a TXT record but the certificate fails

Check that the TXT record was added exactly as indicated by Plesk.

In particular, check:

• the record name, often in the form _acme-challenge;
• the TXT value provided by Plesk;
• the DNS zone actually used by your domain.

Then wait about 10 minutes before clicking Continue again.

My site still shows as not secure

The certificate may be correctly installed, but the browser may still display a warning if the site loads elements over HTTP, such as images, scripts, or stylesheets.

In this case, check that the site’s internal links use HTTPS. On a CMS like WordPress or PrestaShop, it may be necessary to change the site address in the settings or fix mixed content.

The subdomain is not protected

A certificate installed only for the main domain does not automatically protect all subdomains.

To protect a subdomain, you must either include it in the certificate when Plesk offers it, or use a wildcard certificate.

If the certificate is already installed without this scope, regenerate it with the correct options.

HTTPS redirection does not work

Check that the Redirect from HTTP to HTTPS option is enabled in SSL/TLS Certificates.

If your site uses a CMS, a redirect rule in the .htaccess or web.config or an extension can also change the expected behavior.