How to Secure a Website with a Free SSL Certificate in ISPConfig

This guide shows you how to secure a website on your Noiz hosting account with a free SSL certificate from Let's Encrypt, so that visitors reach your site over an encrypted https:// address and see the padlock in their browser. It is written for Noiz clients managing their own hosting through the ISPConfig control panel. An SSL certificate is sometimes called a TLS certificate or an HTTPS certificate; they all mean the same thing. Let's Encrypt is a free, globally trusted certificate authority, and ISPConfig requests and renews its certificates for you automatically, so there is nothing to buy and nothing to renew by hand.

Last reviewed: 27 July 2026, against ISPConfig 3.3.1p1. This article follows the official ISPConfig manual procedure for enabling SSL on a website, cross-checked against the current interface. ISPConfig evolves between releases, so if a screen differs from this guide, check the official documentation links below.

Official Documentation Reference

• Let's Encrypt Error FAQ (HowtoForge forum): the official troubleshooting FAQ for ISPConfig's Let's Encrypt integration, maintained by the ISPConfig developers.
• ISPConfig 3 Documentation: the current official documentation site for ISPConfig.
• ISPConfig Documentation overview: the index of all official ISPConfig documentation, including the full manual.

Prerequisites

• You can log in to the ISPConfig control panel.
• The website already exists in ISPConfig. If not, first follow How to Create a Website in ISPConfig.
• The domain's DNS records point at your Noiz hosting server. This matters more than usual here, as explained in the next section.

How the Free Certificate Is Issued

Before Let's Encrypt issues a certificate, it proves that you control the domain. ISPConfig places a small verification file on your website, and Let's Encrypt then tries to download that file from the public internet for every name attached to the website: the main domain in the Domain field, the auto-subdomain (usually www.yourdomain.com), and any alias domains or subdomains you have added to the site. If even one of those names does not reach your hosting server, no certificate is issued.

This is why DNS must be right first:

• Every name on the site, for example yourdomain.com and www.yourdomain.com, must resolve to the Noiz hosting server from the public internet.
• If you have only just pointed the domain at Noiz, allow time for DNS propagation. Changes usually take effect within minutes to a few hours, but can take up to 24 hours worldwide. Ticking the checkbox too early is the single most common reason the certificate fails.
• If the domain sits behind an external proxy or CDN service, requests may not reach the hosting server directly. Switch such a service to DNS-only mode, or pause it, until the certificate has been issued.

A quick test: open http://yourdomain.com and http://www.yourdomain.com in a browser. If both show your site (or the default welcome page) served from your Noiz account, you are ready to continue.

Enable the Free SSL Certificate

Open the website settings

1. Log in to the ISPConfig control panel.
2. Click the Sites module in the top navigation.
3. In the left menu, under Websites, click Website, then click the domain name of the site you want to secure. The Web Domain form opens on the Domain tab.

Tick SSL and Let's Encrypt SSL

1. On the Domain tab, tick the SSL checkbox. This enables HTTPS for the website.
2. Tick the Let's Encrypt SSL checkbox. This tells ISPConfig to request a free certificate from Let's Encrypt and to keep renewing it automatically. Both boxes must be ticked together, and the panel enforces this for you: ticking Let's Encrypt SSL ticks SSL automatically, and unticking SSL clears Let's Encrypt SSL.
3. Click Save.

You do not need to visit the SSL tab at all. That tab is for creating a self-signed certificate together with a certificate signing request (CSR), which you would use to apply for a certificate from a commercial certificate authority. With Let's Encrypt enabled, the SSL tab stays visible but displays a notice that everything on it applies to non-Let's Encrypt certificates only. Leave it alone; ISPConfig fills in and rotates the certificate for you. If you ever want to move to a purchased certificate instead, untick Let's Encrypt SSL on the Domain tab first.

Wait for the certificate to be issued

1. After saving, watch for the small red change indicator near the top of the panel. It shows a count of changes not yet applied to the server, and clicking it lists what is still outstanding. ISPConfig is contacting Let's Encrypt, running the domain verification and writing the new web server configuration in the background. This normally takes a minute or two.
2. Once the indicator clears, open the website's settings again and check the Domain tab. If Let's Encrypt SSL is still ticked, the certificate was issued successfully.

Important: if the verification fails, ISPConfig quietly unticks the Let's Encrypt SSL checkbox. If the website did not already have SSL switched on before you started, that box is cleared too. The panel does not show an error message, so always re-open the site and check. Let's Encrypt SSL is the box to watch, as it is the one that always clears on failure. If it has unticked itself, see the Troubleshooting section below.

Verify HTTPS Is Working

1. Open https://yourdomain.com in a browser. Note the https:// at the start of the address.
2. Check for the padlock icon next to the address. Click it to view the certificate details; the issuer shows as Let's Encrypt.
3. Repeat for https://www.yourdomain.com if the site uses the www auto-subdomain.

Let's Encrypt certificates are valid for 90 days, and ISPConfig renews them automatically well before they expire. There is nothing you need to do for renewals; the checkbox stays ticked and the certificate keeps rotating in the background.

Redirect All Visitors to HTTPS

With the certificate in place, the site answers on both http:// and https://. To make sure every visitor uses the encrypted address:

1. Open the website's settings again and click the Redirect tab.
2. Tick the Rewrite HTTP to HTTPS checkbox.
3. Click Save and wait for the red change indicator to clear.

Anyone who now types the plain http:// address is sent straight to the secure https:// version. This also avoids duplicate content issues for search engines. Only enable this after you have confirmed HTTPS works, otherwise visitors would be redirected to an address that fails.

This redirect does not interfere with certificate renewals. ISPConfig writes its redirect rules so that the verification path Let's Encrypt uses, /.well-known/acme-challenge/, is left alone. The same applies to the SEO Redirect options on the same tab. A redirect you add yourself, however, in an .htaccess file or inside your application, can block that path and cause renewal to fail, so exclude /.well-known/ from any redirect rule you write by hand.

Troubleshooting

• The Let's Encrypt SSL checkbox unticks itself after saving: the Let's Encrypt verification failed, and this is by far the most common problem. Almost always, one of the names attached to the site does not resolve to the hosting server yet. Check the main domain, the www name and every alias domain or subdomain on the site, fix the DNS records, wait for propagation, then edit the site and tick the boxes again.
• DNS was changed recently and the certificate still fails: propagation may not have finished. Wait a few hours and try again. Repeatedly re-ticking the box within minutes does not help and can trigger temporary rate limits at Let's Encrypt, which then force a longer wait.
• The certificate fails while a proxy or CDN service sits in front of the domain: the verification requests are not reaching the hosting server. Set the service to DNS-only mode, or pause it, tick the boxes again, and re-enable the proxy once the certificate has been issued.
• HTTPS works on yourdomain.com but not on www.yourdomain.com: the www name is either missing a DNS record or is not attached to the website. Check that Auto-Subdomain on the Domain tab is set to www. and that a DNS record for www points at the server, then save and re-tick the checkboxes if needed.
• The browser shows a certificate warning straight after enabling SSL: the new configuration may still be rolling out. Wait for the red change indicator to clear, then reload the page with a hard refresh. If the warning persists, re-open the site settings and confirm the checkboxes are still ticked.
• The padlock shows "not fully secure" or a warning triangle: the certificate is fine, but the page loads some images, styles or scripts over plain http://. This is called mixed content. Update your site's own settings and content to use https:// addresses; in WordPress, for example, change the site address settings to the https:// version.
• An alias domain or subdomain added later broke the certificate renewal: every name on the site is re-verified at renewal time, so a new alias without working DNS can cause a failure. Make sure any name you add to the website resolves to the server before you add it. If a particular name cannot be made to resolve, for example one that is parked elsewhere, open that alias domain or subdomain and tick Don't add to Let's Encrypt certificate. That leaves the name off the certificate so it stops blocking issue and renewal for the rest of the site.

If you get stuck at any point, open a support ticket with the Noiz support team and include the domain name, the approximate time you ticked the Let's Encrypt SSL checkbox, and whether that checkbox was still ticked when you re-opened the website settings.