These instructions apply to Plesk Obsidian (v18.x) on Windows servers. For instructions for other versions of Plesk please contact our support department by emailing support@managed.com.

 

Let's Encrypt is a free SSL certificate run by a non-profit certificate authority. The certificates are valid for 90 days and can include multiple domains. Plesk features a plugin which allows these certificates to be easily installed on a domain and will renew them automatically every 60 days. If you'd prefer to have a certificate that's valid for a full year at a time, Managed.com offers a selection of selection of certificates.

 

Setting up Let's Encrypt can be done by customers in either shared environments or on a dedicated server. Please carefully follow the steps below:

Pay careful attention to any errors that appear, as they will include information on why the issuance failed. Below are several common errors you may come across.

 

The most common cause of this error is due to DNS records not pointing to the server. Please verify that each domain's A record points to the server's IP address. If you're securing the www, mail, or webmail domains please check that these all have valid records as well.

 

Check to see if you can open the URL for the token listed in the error message (usually something like http://domain.com/.well-known/pki-validation/ebfwirt794tjr5gg2g4h8trfbjrfg8). If you're redirected to another page on your site, such as the home page, then your site's CMS is rewriting the web request URL. Please contact our support team for advice on how to proceed as the method for allowing the directory various between CMSes. If you aren't redirected and can view the file, but the URL is directed to https then you need to disable the https redirect in Plesk. If you're redirecting traffic to https through the web.config file then modify the rule to reflect the following:

<rewrite>
    <rules>
        <rule name="HTTP to HTTPS redirect" stopProcessing="true">
        <match url="(.*)" />
        <conditions>
        	<add input="{HTTPS}" pattern="off" ignoreCase="true" />
			<add input="{REQUEST_URI}" negate="true" pattern="^/.well-known/*$" ignoreCase="true" />
        </conditions>
        <action type="Redirect" redirectType="Permanent" url="https://{HTTP_HOST}/{R:1}" />
        </rule>
    </rules>
</rewrite>

1. Connect to the server via RDP
2. Right-click on the folder C:\inetpub\temp\appPools\acme-challenge, then click on Properties
3. On the Security tab, check that the IIS_IUSRS group is listed and that it has read and write access on the folder
4. Click Apply button
5. Open IIS
6. Click on Server Name > Application Pools and make sure that the acme-challenge application pool is running
7. Click on Server Name > Sites > acme-challenge and make sure that the site is not stopped
8. Re-issue SSL certificate in Domains > example.com > SSL/TLS Certificates