Domains and HTTPS

What this page is for. Point your domain name at this server and get a free certificate, so visitors see the padlock instead of a warning.

You need

• A domain name you own.
• Access to that domain's DNS settings — or a Cloudflare API token connected to the panel, in which case the panel does the DNS part for you.
• The panel open on Domain & SSL (a Project page).

How this works, in four sentences

A domain name is a label. DNS is the phone book that turns that label into your server's IP address. Something has to add an A record pointing the name at this server — either you at your DNS provider, or the panel on your behalf when Cloudflare is connected. Once the name arrives here, SixPanel asks Let's Encrypt for a free certificate and turns on https.

Each name moves through three states, shown as chips on the page:

added → pointed → secured

• added — SixPanel knows about the name.
• pointed — the name really resolves to this server.
• secured — a certificate is installed and https works.

The three groups

The Domain & SSL page has one card per group. A group can hold more than one name.

1. Add the name

In the right card, type the bare name — shop.example.com, with no https:// and no slash — and press Add domain.

Expected result: the name appears with an added chip. If DNS already points here you also get pointed straight away.

When you created the project from a single domain, all of this was already filled in for you: the panel derived the admin, website, www and websocket names and registered them. This card is then for adding an extra name later.

2. Point it at this server

If Cloudflare is connected, you do not do this by hand. The panel creates the A records for you, and every record it creates is proxied — the orange cloud — so your server's address never appears in public DNS.

One rule follows from that, and the panel enforces it. Cloudflare's free certificate covers your domain and one level below it: example.com and shop.example.com, but not dash.shop.example.com. A proxied name that sits deeper answers every HTTPS connection with a handshake failure at Cloudflare's edge, before your server is even dialled. So the panel picks names that fit: a name that would sit deeper is flattened with a hyphen — dash-shop.example.com, ws-shop.example.com, panel-shop.example.com — and if you type a deeper name by hand the panel refuses it and shows you the spelling that works. There is no "turn the proxy off for this one" option, because a name with the proxy off publishes the address of your server.

If Cloudflare is not connected, the card shows This server's IP address (for the A records) with a copy button. Copy that number, and at your domain provider create a DNS A record:

Then press Re-check on that row, or Re-check DNS at the top of the page.

Expected result: the chip turns to pointed.

DNS changes are not instant. A few minutes is normal, and some providers take longer. The row tells you what the name currently resolves to, so you can see the change arrive.

3. Get HTTPS

Press Get free SSL on the row. The button stays disabled until the name is pointed.

The panel checks DNS again, asks Let's Encrypt for a certificate, writes the web server configuration and reloads it. You watch the log as it runs. It takes under a minute.

Expected result: the chip turns to secured, and https://your-domain opens with a padlock.

There are two ways the panel can prove to Let's Encrypt that the name is yours, and it picks the better one automatically:

• Through Cloudflare (DNS-01). When a stored Cloudflare token manages the name's zone, the panel proves control by writing a temporary DNS record. This needs no port 80 at all, works with the orange cloud on, and produces a real certificate that satisfies Cloudflare's strictest setting.
• Over port 80 (HTTP-01). Otherwise Let's Encrypt fetches a file from your server over plain http, so port 80 has to be reachable.

The log says which one ran. Renewal is automatic: a daily job renews every certificate before it expires, and the web server is reloaded for each one separately, so one certificate with a problem can never freeze the others. There is nothing to remember and nothing to pay.

If you use Cloudflare

Every record the panel creates is proxied — that is the whole point of having Cloudflare there, and it is not optional in this panel.

Press Get free SSL as normal and the panel handles the rest:

• The usual case. With a Cloudflare token connected, it gets a real Let's Encrypt certificate by writing a DNS record, straight through the proxy. Set Cloudflare's SSL/TLS mode to Full (strict).
• Without a token, it first tries for a real certificate through the proxy over port 80. If that cannot pass on your zone, it installs a certificate the server signs itself, for the Cloudflare-to-server leg only. Your visitors still get Cloudflare's own trusted certificate. Set Cloudflare's SSL/TLS mode to Full — not Full (strict).

The panel tells you which of the three happened, in the log and on the page. Connecting a token is worth the five minutes: it removes the self-signed case entirely.

Keep one group consistent. One certificate serves one mode, so all the names of one card must be either all proxied or all direct — not a mix. The panel says so and leaves the odd one out of the certificate rather than breaking the rest.

Adding more names to one project

Add as many as you like to a card, and give each one its own certificate with Get free SSL. A common pair is example.com and www.example.com.

Make primary changes which name is the main one. For the admin site, the primary is the address the app and the mobile apps switch to, so change it only when you mean it.

Remove takes a name off this server. Visitors using it stop reaching the site. The name itself still belongs to you at your provider. The admin site's primary name cannot be removed — replace it instead.

A newly added name has no certificate until you press Get free SSL for that name.

How to check it worked

• The row shows all three chips: added, pointed, secured.
• https://your-domain opens with a padlock and no warning.
• Server → Health shows no certificate problems.
• sudo sixpanel ssl status lists the certificate, its issuer and the days left.

If it went wrong

"does not resolve to \<ip\>" The A record is missing, wrong, or has not spread yet. Fix it, wait a few minutes, press Get free SSL again.

The certificate step times out When the panel is using the port-80 method, port 80 must be open to the internet — or, behind Cloudflare, to Cloudflare's addresses. See The three ports. Connecting a Cloudflare token removes this dependency altogether.

"ACME_EMAIL is not set" / the log says the email address is unusable Let's Encrypt needs a real email address. Set it under Settings, then try again. Without one the panel can only write a self-signed certificate.

Cloudflare error 526 (Invalid SSL certificate) Your zone is set to Full (strict) but the server is using a self-signed certificate. Either press Get free SSL again — if the check can pass now, the panel upgrades to a real certificate by itself — or set the zone to Full.

The panel refused a name and suggested a different spelling That name would sit more than one level below your Cloudflare domain, where the free Cloudflare certificate does not reach. Use the spelling the panel offers (dash-shop.example.com rather than dash.shop.example.com).

"too many certificates" Let's Encrypt limits how many certificates one set of names may get per week. Wait, or use a slightly different set of names.

The panel's own address Giving the panel its own domain is a different setting, on the Security page. Read the lock-out warning in First login before you use it.

More causes and fixes: When something is broken.