Get a free SSL certificate for your website

Under the website's certificate section — HTTPS for your website — Request a Let's Encrypt certificate issues one covering the names that resolve to this server, and renews it before it runs out. Installed certificate then shows what is actually in place: which names it covers, and when it expires.

• Point the domain at the server first. A certificate is issued by proving you control the name, so it has to resolve here before anything can be issued.
• Add every name you want covered, including www if you use it.
• A name added later joins within the hour, so there is nothing to reissue by hand.

If issuing fails, it is almost always DNS: the name does not resolve here yet, or it resolves somewhere else. DNS zones and nameservers covers pointing it.

Your own certificate takes one you already hold — a wildcard, or one from an authority you run yourself. It is checked before it is installed rather than after, and the panel names any domain on the website that the certificate does not cover, which is the mistake a wildcard usually hides.

The private key is stored so that only root can read it. It is never served, never shown back to you, and does not travel: moving a website to another server does not carry its key, which is why a moved site is issued a new certificate there rather than handed the old one.

Remove certificate takes one off again. Request / renew certificate is also how you force a renewal early, if a name changed and you would rather not wait.