Issue a certificate

Get free Let's Encrypt TLS for a site domain (HTTP-01 or Cloudflare DNS-01).

Who can use this page? Site manage — SSL / TLS page or site certificate actions.

Open

Sidebar → SSL / TLS, or the site’s certificate action.

Before you start

1. DNS A/AAAA for the domain → NitHost server public IP
2. Server ports 80 (HTTP-01) and 443 reachable
3. Site active and vhost serving the domain

HTTP-01 (default)

1. Issue certificate / request Let's Encrypt for the domain
2. Certbot performs a webroot challenge on /.well-known/acme-challenge/
3. Certificate installs; Nginx reloads (zero-downtime)
4. HTTP → HTTPS redirect enables when configured

Auto-renewal runs on the certbot container roughly every 12 hours.

DNS-01 (Cloudflare)

Use when HTTP-01 cannot work (proxied constraints, internal-only HTTP, multi-level domains).

1. Create a Cloudflare API token scoped to the zone (DNS edit)
2. In the site editor’s Cloudflare DNS-01 field, paste the token
3. Issue the certificate — DNS-01 challenge runs
4. Keep the token available for renewals (NitHost persists creds for certbot renew loops)

Custom certificates

Upload an existing cert/key pair (fullchain + key) for paid or internal CAs. NitHost stores expiry and includes it in the SSL list.

After issuing

• Confirm the lock icon in a browser
• Renewal is automatic — watch expiry column
• Keep your contact email current and check certificate expiry in the panel

Wildcards

Wildcard certs require DNS-01 with a token that allows *.example.com.

Related

• Renewal
• Troubleshooting