How do I install a Let’s Encrypt SSL/TLS certificate on Plesk?

Procédure

This help explains how to install a free Let’s Encrypt SSL/TLS certificate on a domain from Plesk.
Once installed, the certificate allows your site to be displayed over HTTPS and encrypts exchanges between the visitor’s browser and your site.

An SSL/TLS certificate does not secure the site itself: it does not fix vulnerabilities in the code, does not automatically protect a CMS such as WordPress or PrestaShop, and does not guarantee that the site owner is trustworthy.

Let’s Encrypt certificate renewal is automatic. You therefore do not need to renew it manually as long as the domain remains correctly configured.

Before you begin

The domain must point correctly to your Plesk hosting before requesting the certificate.

If you want to install a wildcard certificate, that is, a certificate that also covers subdomains, you must be able to modify the domain’s DNS zone. If the DNS zone is not managed in Plesk or at LWS, the requested record must be added with the provider that manages the domain’s DNS.

Accessing SSL/TLS certificates in Plesk

1. Log in to Plesk.
2. Select the relevant domain (1) from your site list.
3. In the Dashboard (2) tab, locate the Security section.
4. Click on SSL/TLS Certificates (3).

If no certificate is installed, Plesk displays a message indicating that the domain is not yet protected.

Install a Let’s Encrypt certificate

1. On the domain’s Let’s Encrypt SSL/TLS Certificate page, click Install [ADDRESS] Install a free basic certificate provided by Let’s Encrypt.
   
2. A window opens with the certificate protection options.
3. Choose the certificate scope according to [PERSON_NAME]

• Secure the domain name: protects the main domain, for example votredomaine.fr.
• Include a "www" [PERSON_NAME] for the domain and each selected alias: [PERSON_NAME] www.votredomaine.fr.
• Protect the Wildcard domain: protects the domain and its subdomains, for example blog.votredomaine.fr, boutique.votredomaine.fr or webmail.votredomaine.fr.

4. Click Get for free.

Validate installation by DNS

Plesk [PERSON_NAME] TXT DNS record.

This step allows Let’s Encrypt to confirm that you [PERSON_NAME] domain.

Plesk then displays the information to use, for example:

• Record type: TXT;
• Domain name: _acme-challenge.votredomaine.fr;
• Record: a long value provided by Plesk.

If your DNS zone is managed in Plesk, check that the requested TXT record is present under Websites & Domains > DNS Settings.

If your DNS zone is managed elsewhere, [PERSON_NAME] with the provider that manages the domain’s DNS.

Once the wait is over, return to Plesk and click Continue.

Enable HTTP to HTTPS redirection

Installing the certificate allows the site to work over HTTPS, but it does not always automatically force visitors to use this secure address.

To automatically redirect visitors from http:// to https://:

1. Go back to Websites & Domains > SSL/TLS Certificates.
   
2. In the left column, locate the Redirect from HTTP to HTTPS option.
   
3. Enable the corresponding switch.
4. Then check that your site opens correctly over HTTPS when you enter the address over HTTP.

Enable HSTS

HSTS is an option that tells browsers [PERSON_NAME]>

This option strengthens the use of HTTPS, but it must be enabled with caution.

To enable HSTS:

1. In SSL/TLS Certificates, [PERSON_NAME] HSTS in the left column.
   
2. Enable the HSTS switch.
3. Choose the Max age. The 6 months value is generally recommended.
4. Check Include subdomains only if all your subdomains are properly protected by HTTPS.
   
5. Click Enable HSTS.

Check that the certificate works

After installation, open your site in a browser using the following address:

https://votredomaine.fr

Then check:

• that the site displays correctly;
• that the browser does not display a security warning;
• that Plesk indicates the domain as Secured;
• that https://www.votredomaine.fr works if you included www;
• that your subdomains work over HTTPS if you installed a wildcard certificate.

If you enabled HTTP to HTTPS redirection, [PERSON_NAME] :

http://votredomaine.fr

The browser should automatically switch to:

https://votredomaine.fr

Regenerate the certificate

If you want to modify the elements protected by the certificate, for example add www or switch from a standard certificate to a wildcard certificate, you must regenerate the certificate.

To do this:

1. Go back to Websites & Domains > SSL/TLS Certificates.
   
2. Click Regenerate certificate.
   
3. Select the new desired scope.
4. Validate the request.
5. If Plesk asks for DNS validation, [PERSON_NAME] check the TXT record, [PERSON_NAME] 10 minutes, [ADDRESS] Continue.

Common issues

The certificate does not install and Plesk displays a DNS error

If Plesk displays an error such as DNS problem or NXDOMAIN, [PERSON_NAME] Let’s Encrypt cannot find the correct DNS pointing for your domain.

Check that:

• the domain correctly points to your Plesk hosting;
• the DNS servers used are the correct ones;
• the domain’s A or AAAA records exist;
• DNS propagation is complete.

After correcting this, restart certificate generation.

Plesk requests a TXT record but the certificate fails

Check that the TXT record was added exactly as indicated by Plesk.

In particular, check:

• the record name, often in the form _acme-challenge;
• the TXT value provided by Plesk;
• the DNS zone actually used by your domain.

Then wait about 10 minutes before clicking Continue again.

My site still shows as unsecured

The certificate may be installed correctly, but the browser may still display a warning if the site loads elements over HTTP, such as images, scripts, or stylesheets.

In this case, check that the site’s internal links use HTTPS. On a CMS such as WordPress or PrestaShop, it may be necessary to change the site address in the settings or fix mixed content.

The subdomain is not protected

A certificate installed only for the main domain does not automatically protect all subdomains.

To protect a [PERSON_NAME], you must either include it in the certificate when Plesk offers it, or use a wildcard certificate.

If the certificate is already installed without [PERSON_NAME], regenerate it with the correct options.

HTTPS redirection does not work

Check that the Redirect from HTTP to HTTPS option is enabled in SSL/TLS Certificates.

If your site uses a CMS, a redirection rule present in the .htaccess or web.config or file or in an extension can also change the expected behavior.