How To Install Free SSL On Cyberpanel

Installing an SSL certificate on CyberPanel encrypts data exchanged between your website and its visitors. It also enables HTTPS, removes browser security warnings, protects login and payment information, and helps establish user trust.

CyberPanel can request and install a free SSL certificate automatically through its built-in SSL management tools. In most cases, the process takes only a few minutes, provided that your domain, DNS records, firewall, and website configuration are correct.

This guide explains how to install a free SSL certificate on CyberPanel, upload a custom certificate, force HTTPS, verify the installation, and troubleshoot common certificate errors.

What Is an SSL Certificate?

An SSL certificate is a digital certificate that allows a website to use HTTPS. Although the modern encryption protocol is technically TLS, the term SSL certificate is still widely used.

When HTTPS is active:

Information exchanged between the browser and server is encrypted.
Visitors can verify that they are connected to the intended domain.
Passwords, forms, cookies, and payment information receive stronger protection during transmission.
Browsers display a secure connection indicator instead of a warning.
Modern features that require secure connections can work correctly.

An SSL certificate does not protect a website from every type of attack. You must still maintain secure passwords, software updates, backups, firewall rules, malware protection, and safe application code.

Requirements Before Installing SSL on CyberPanel

Before clicking Issue SSL, confirm that the following requirements are met.

1. The Domain Must Point to the CyberPanel Server

The domain’s DNS records must resolve to the public IP address of the CyberPanel server.

A typical IPv4 DNS configuration includes:

example.com       A       203.0.113.10
www.example.com   A       203.0.113.10

Replace the sample IP with your actual server IP.

If you use IPv6, the domain’s AAAA record must also point to a working IPv6 address on the same server. An incorrect AAAA record is a common reason certificate validation fails even when the A record is correct.

2. The Website Must Exist in CyberPanel

CyberPanel can normally issue a website certificate only after the domain has been added under its website-management section.

3. Ports 80 and 443 Must Be Open

Certificate validation and HTTPS traffic commonly require:

TCP port 80: HTTP and domain validation.
TCP port 443: HTTPS traffic.

Check the server firewall, hosting-provider firewall, security group, and router rules to ensure these ports are reachable from the internet.

4. The Domain Must Be Publicly Accessible

A certificate authority cannot validate a domain that exists only in a local hosts file, private network, or internal DNS system.

5. DNS Changes Must Have Propagated

After changing DNS records, allow enough time for resolvers around the internet to receive the new values.

You can check the current result from a command line:

dig +short example.com
dig +short www.example.com

or:

nslookup example.com
nslookup www.example.com

The returned IP address should match your CyberPanel server.

How to Install a Free SSL Certificate on CyberPanel

Step 1: Log In to CyberPanel

Open the CyberPanel administration interface:

https://server-hostname.example.com:8090

You can also temporarily use the server IP:

https://203.0.113.10:8090

Replace the sample hostname or IP address with your actual server details.

If CyberPanel is still using a self-signed certificate, the browser may display a privacy warning. Confirm that you are connecting to the correct server before continuing.

Security note: Do not routinely ignore certificate warnings. After completing the initial server setup, install a valid hostname SSL certificate for the CyberPanel login interface.

Step 2: Create or Confirm the Website

From the CyberPanel dashboard, open:

Websites → List Websites

Confirm that the target domain appears in the list.

If the website has not been created:

Go to Websites > Create Website.
Select the website owner and hosting package.
Enter the domain name.
Enter a valid email address.
Select the required PHP version.
Enable any appropriate additional options.
Click Create Website.

CyberPanel may offer an SSL option during website creation. This option works only if the domain already points to the server and can be validated.

Step 3: Open Manage SSL

In the CyberPanel sidebar, go to:

SSL → Manage SSL

Select the website from the domain list.

Step 4: Issue the Certificate

Click Issue SSL.

CyberPanel will attempt to:

Verify control of the selected domain.
Request a certificate from the configured certificate authority.
Install the certificate and private key.
Configure the website to serve HTTPS traffic.

Wait for the success message before leaving the page.

Step 5: Test the HTTPS Version

Open your website in a private browser window:

https://example.com
https://www.example.com

Confirm that:

The page loads successfully.
No certificate warning appears.
The certificate contains the domain being visited.
Images, stylesheets, scripts, and fonts load correctly.

How to Force HTTP to HTTPS in CyberPanel

Installing a certificate does not always guarantee that every HTTP request will automatically redirect to HTTPS.

To prevent visitors and search engines from accessing both versions, configure a permanent redirect from HTTP to HTTPS.

Method 1: Use CyberPanel Rewrite Rules

Open the website management section and locate its rewrite-rule configuration. Add an HTTPS redirect supported by your OpenLiteSpeed setup.

A common rule is:

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]

Test the website immediately after saving the rule. Incorrect rewrite syntax can cause redirect loops or HTTP 500 errors.

Method 2: Use the Application Settings

Some content management systems include their own HTTPS or canonical URL settings.

For WordPress, verify the following addresses under:

Settings → General

Both should use HTTPS:

WordPress Address: https://example.com
Site Address:      https://example.com

Do not configure several competing redirect systems at the same time. A CDN redirect, CyberPanel rule, WordPress plugin, and application-level redirect can conflict and produce an infinite loop.

How to Install a Custom SSL Certificate on CyberPanel

A custom certificate may be appropriate when your organization already owns a certificate issued by a commercial certificate authority or has specific compliance requirements.

You will normally need:

The domain certificate.
The intermediate certificate chain or CA bundle.
The matching private key.

The private key must match the public key in the certificate. A certificate copied from another server will not work unless the corresponding private key is also available.

Step 1: Back Up the Existing Certificate

Before replacing a working certificate, save a secure backup of the current certificate and key or create a complete server backup.

Never send a private key through unencrypted email or publish it in a support ticket.

Step 2: Open the Custom SSL Section

In CyberPanel, select the target website and locate the option for adding or uploading a custom SSL certificate.

The exact menu wording may vary by CyberPanel version, but it may appear under the website’s management options as Add SSL or a similar setting.

Step 3: Paste the Full Certificate Chain

In the certificate field, paste the domain certificate first, followed by the intermediate certificate or certificates.

-----BEGIN CERTIFICATE-----
DOMAIN CERTIFICATE CONTENT
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
INTERMEDIATE CERTIFICATE CONTENT
-----END CERTIFICATE-----

Do not paste explanatory text, filenames, quotation marks, or spaces before the first BEGIN CERTIFICATE line.

Step 4: Paste the Private Key

In the private-key field, paste the complete matching key:

-----BEGIN PRIVATE KEY-----
PRIVATE KEY CONTENT
-----END PRIVATE KEY-----

Depending on how the key was generated, its header may instead be:

-----BEGIN RSA PRIVATE KEY-----

Keep the original header and footer intact.

Step 5: Save and Reload the Web Server

Save the certificate. CyberPanel may reload OpenLiteSpeed automatically.

If the new certificate does not appear, use the panel’s LiteSpeed restart function:

Server Status → LiteSpeed Status → Restart LiteSpeed

If you manage the server through SSH, check the service before restarting it:

systemctl status lsws

Restart only when necessary:

systemctl restart lsws

How to Check Whether the Certificate and Private Key Match

If CyberPanel rejects a custom certificate, confirm that the certificate and private key belong together.

For an RSA certificate, compare their public-key fingerprints:

openssl x509 -in certificate.crt -pubkey -noout 
| openssl sha256

openssl pkey -in private.key -pubout 
| openssl sha256

The two SHA-256 results should be identical.

Also inspect the certificate details:

openssl x509 -in certificate.crt -text -noout

Check:

The certificate’s valid-from and expiration dates.
The subject alternative names.
The issuing certificate authority.
The domain names covered by the certificate.

How to Install SSL for the CyberPanel Hostname

The certificate used by a hosted website is separate from the certificate used by the CyberPanel administration interface.

For example:

https://example.com uses the website certificate.
https://panel.example.com:8090 uses the CyberPanel hostname certificate.

Before issuing a hostname certificate:

Create a hostname such as panel.example.com.
Point its DNS A record to the CyberPanel server.
Confirm that the hostname resolves publicly.
Use CyberPanel’s hostname SSL option to issue the certificate.
Access the panel through the hostname rather than the raw IP address.

A public certificate for a hostname does not automatically cover the server IP address unless the certificate explicitly contains that IP.

How CyberPanel Renews Free SSL Certificates

Free certificates have limited validity periods and should be renewed automatically before they expire. CyberPanel normally manages this process through its integrated certificate client and scheduled tasks.

You should not wait until a certificate expires before checking renewal.

Recommended monitoring practices include:

Check certificate expiration dates regularly.
Configure uptime and SSL-expiry monitoring.
Maintain correct DNS records.
Keep ports 80 and 443 accessible.
Review scheduled jobs and logs after server changes.
Test renewal after modifying DNS, CDN, firewall, or proxy settings.

The certificate authority is reducing certificate lifetimes over time, making reliable automatic renewal increasingly important. Avoid building a process that depends on manual renewal shortly before expiration.

Common Reasons CyberPanel Cannot Issue SSL

1. The Domain Points to the Wrong Server

Check both A and AAAA records. Every address returned for the domain must reach a server capable of completing the validation request.

2. DNS Has Not Finished Propagating

If the domain was recently updated, some DNS resolvers may still return the old server address. Wait for the relevant DNS cache to expire before retrying.

3. Port 80 Is Blocked

A firewall, cloud security group, router, or internet provider may be preventing HTTP validation.

On the server, check whether a service is listening:

ss -lntp | grep -E ':80|:443'

4. Cloudflare Proxy Interferes with Validation

If the domain uses Cloudflare, temporarily changing the relevant DNS record from proxied to DNS-only may help isolate validation problems.

After the certificate has been issued and HTTPS works directly on the server, you may re-enable the proxy and choose a secure Cloudflare SSL mode.

Avoid using Cloudflare’s Flexible mode for a server that already supports HTTPS because it may cause redirect loops and leaves the Cloudflare-to-origin connection unencrypted.

5. An Incorrect IPv6 Record Exists

If a domain has both A and AAAA records, validation may reach the IPv6 address. Remove an incorrect AAAA record or configure IPv6 correctly on the server.

6. The www Subdomain Is Not Configured

If CyberPanel requests a certificate covering both the root domain and www, both hostnames must resolve correctly.

7. Too Many Failed Certificate Requests

Certificate authorities apply request limits. Repeatedly clicking Issue SSL without correcting the underlying problem may temporarily prevent further attempts.

Check DNS and firewall conditions before trying again.

8. The Domain Is Behind an Unsupported Forwarding Service

Registrar URL forwarding, parking pages, and external redirects may prevent CyberPanel from answering the validation request.

9. The Server Time Is Incorrect

Check the current server time:

timedatectl

Enable network time synchronization if necessary:

timedatectl set-ntp true

10. CyberPanel or Its Certificate Client Is Outdated

Older CyberPanel installations may contain outdated certificate-management components. Back up the server and follow the official CyberPanel update process before making major changes.

How to Diagnose SSL Errors Through SSH

Check DNS

dig +short example.com A
dig +short example.com AAAA
dig +short www.example.com A
dig +short www.example.com AAAA

Check HTTP Access

curl -I http://example.com

Check HTTPS Access

curl -Ik https://example.com

Inspect the Live Certificate

openssl s_client 
-connect example.com:443 
-servername example.com 
-showcerts < /dev/null

Display the Certificate Expiration Date

echo | openssl s_client 
-connect example.com:443 
-servername example.com 2>/dev/null 
| openssl x509 -noout -dates

Check OpenLiteSpeed

systemctl status lsws

Check Recent OpenLiteSpeed Errors

tail -n 100 /usr/local/lsws/logs/error.log

Log locations may differ depending on the CyberPanel and OpenLiteSpeed configuration.

How to Fix Mixed Content After Enabling HTTPS

Mixed content occurs when an HTTPS page loads images, scripts, stylesheets, fonts, or frames through HTTP.

The browser may block these resources or continue showing a security warning.

Common Causes

Hard-coded HTTP image URLs.
Old site URLs stored in a database.
HTTP links in themes or templates.
External scripts that do not support HTTPS.
Incorrect CDN configuration.

How to Fix It

Update internal asset URLs to HTTPS.
Replace old website URLs safely in the database.
Update theme, plugin, and application settings.
Remove third-party resources that do not support HTTPS.
Clear application, LiteSpeed, CDN, and browser caches.
Use the browser developer console to identify blocked resources.

Do not perform a raw database search-and-replace on serialized WordPress data unless the tool understands serialization.

How to Verify an SSL Installation

After installing the certificate, verify more than the browser padlock.

Check that:

The certificate has not expired.
The domain appears in the certificate’s subject alternative names.
The complete intermediate chain is installed.
HTTP redirects to the correct HTTPS URL.
There is no redirect loop.
The website does not contain mixed content.
Both the root domain and www version behave consistently.
The website works on mobile devices and different browsers.
The origin server remains secure when a CDN is enabled.

You may use a reputable online SSL analysis service or inspect the certificate directly with OpenSSL.

Free SSL vs. Paid SSL

Feature	Free SSL	Paid SSL
Encryption	Provides standard HTTPS encryption	Provides standard HTTPS encryption
Cost	No certificate fee	Annual or subscription fee
Validation	Usually domain validation	May offer domain or organizational validation
Renewal	Designed for automated renewal	Depends on provider and installation method
Provider Support	Community or hosting support	May include commercial support

Encryption

Free SSL: Provides standard HTTPS encryption

Paid SSL: Provides standard HTTPS encryption

Cost

Free SSL: No certificate fee

Paid SSL: Annual or subscription fee

Validation

Free SSL: Usually domain validation

Paid SSL: May offer domain or organizational validation

Renewal

Free SSL: Designed for automated renewal

Paid SSL: Depends on provider and installation method

Both free and paid certificates can provide strong transport encryption when installed correctly. A paid certificate does not automatically make application code, hosting, passwords, or databases more secure.

CyberPanel SSL Installation Checklist

Add the website to CyberPanel.
Point the domain’s A record to the server.
Correct or remove an invalid AAAA record.
Confirm that both root and www hostnames resolve correctly.
Open ports 80 and 443.
Temporarily disable conflicting proxy settings when necessary.
Open SSL > Manage SSL.
Select the correct website.
Click Issue SSL.
Test the HTTPS version.
Configure one HTTP-to-HTTPS redirect.
Fix mixed content.
Check the certificate chain and expiration date.
Configure monitoring for renewal failures.

Frequently Asked Questions

Is SSL Free on CyberPanel?

CyberPanel includes tools for requesting domain-validated certificates without a certificate fee. Your VPS, domain name, CyberPanel-related services, or technical support may still involve separate costs.

How Long Does a Free SSL Certificate Last?

Free certificates have short validity periods and should be renewed automatically before expiration. Certificate lifetimes are changing across the industry, so reliable automated renewal is more important than relying on a fixed manual schedule.

Does CyberPanel Renew SSL Automatically?

CyberPanel is designed to manage renewal automatically through its certificate tooling and scheduled tasks. However, renewal can fail if DNS records, firewall rules, proxies, the web server, or scheduled jobs are changed or broken.

Why Did CyberPanel Issue a Self-Signed Certificate?

This can happen when CyberPanel cannot validate the domain through a public certificate authority. Check DNS resolution, ports 80 and 443, IPv6 records, proxy settings, and server accessibility.

Do I Need a Dedicated IP for SSL?

Most modern websites do not require a dedicated IP for HTTPS because current browsers and web servers support Server Name Indication. A dedicated IP may still be useful for other infrastructure or email-related requirements.

Can I Install One Certificate on Several Domains?

Only when all required hostnames are included in the certificate’s subject alternative names or covered by an appropriate wildcard certificate.

Does a Wildcard Certificate Cover the Root Domain?

A wildcard such as *.example.com covers subdomains like shop.example.com, but it does not necessarily cover the root domain example.com. Both names should be included when required.

Why Is My Browser Still Showing “Not Secure”?

The certificate may be invalid, expired, issued for another hostname, missing an intermediate certificate, or the page may contain mixed HTTP content. Inspect the browser’s certificate and developer-console details.

Should I Restart OpenLiteSpeed After Installing SSL?

CyberPanel may apply the certificate automatically. Restart OpenLiteSpeed only if the updated certificate is not loaded or the panel specifically requires it.

Can I Use Cloudflare with CyberPanel SSL?

Yes. Install a valid certificate on the CyberPanel origin server and use an end-to-end encrypted Cloudflare SSL mode. Review proxy, DNS, and redirect settings carefully to avoid validation failures and redirect loops.

Does SSL Improve SEO?

HTTPS is part of a secure and trustworthy website and is supported by modern browsers and search engines. However, installing SSL alone will not compensate for weak content, poor performance, technical SEO problems, or a bad user experience.

Conclusion

Installing a free SSL certificate on CyberPanel is straightforward when the domain points to the correct server and the required ports are accessible.

The recommended process is to:

Verify DNS records before issuing the certificate.
Use CyberPanel’s SSL > Manage SSL feature.
Test both the root and www versions of the website.
Redirect HTTP traffic to HTTPS.
Resolve mixed-content warnings.
Monitor certificate expiration and automated renewal.

For custom certificates, always install the complete certificate chain and the matching private key. Protect the private key carefully and create backups before replacing a working certificate.

If you need assistance with CyberPanel, HTTPS configuration, SSL troubleshooting, website migration, or server security, VietSEO provides professional SSL certificate and HTTPS configuration services for websites and VPS environments.