# Domains and HTTPS > Source: https://www.allsweb.com/sixpanel/docs/domain-ssl > Markdown for agents: https://www.allsweb.com/sixpanel/docs/domain-ssl.md > Publisher: AllsWeb (www.allsweb.com) Part of: SixPanel documentation **What this page is for.** Point your domain name at this server and get a free certificate, so visitors see the padlock instead of a warning. **You need** - A domain name you own. - Access to that domain's DNS settings — or a Cloudflare API token connected to the panel, in which case the panel does the DNS part for you. - The panel open on **Domain & SSL** (a Project page). --- ## How this works, in four sentences A domain name is a label. DNS is the phone book that turns that label into your server's IP address. Something has to add an **A record** pointing the name at this server — either you at your DNS provider, or the panel on your behalf when Cloudflare is connected. Once the name arrives here, SixPanel asks Let's Encrypt for a free certificate and turns on `https`. Each name moves through three states, shown as chips on the page: **added** → **pointed** → **secured** - **added** — SixPanel knows about the name. - **pointed** — the name really resolves to this server. - **secured** — a certificate is installed and `https` works. ## The three groups The **Domain & SSL** page has one card per group. A group can hold more than one name. | Card | What it is for | |---|---| | **Admin site (main domain)** | Your 6ammart admin panel, and the address the mobile apps talk to. The name marked **primary** is the main one. | | **Customer website** | The storefront your customers browse. See **[The customer website](https://www.allsweb.com/sixpanel/docs/customer-website)**. | | **Live updates (websockets)** | An optional separate name for real-time order updates. See **[Live order updates](https://www.allsweb.com/sixpanel/docs/live-updates)**. | --- ## 1. Add the name In the right card, type the bare name — `shop.example.com`, with no `https://` and no slash — and press **Add domain**. **Expected result:** the name appears with an **added** chip. If DNS already points here you also get **pointed** straight away. When you created the project from a single domain, all of this was already filled in for you: the panel derived the admin, website, `www` and websocket names and registered them. This card is then for adding an extra name later. ## 2. Point it at this server **If Cloudflare is connected**, you do not do this by hand. The panel creates the A records for you, and every record it creates is **proxied** — the orange cloud — so your server's address never appears in public DNS. One rule follows from that, and the panel enforces it. Cloudflare's free certificate covers your domain and **one level below it**: `example.com` and `shop.example.com`, but not `dash.shop.example.com`. A proxied name that sits deeper answers every HTTPS connection with a handshake failure at Cloudflare's edge, before your server is even dialled. So the panel picks names that fit: a name that would sit deeper is flattened with a hyphen — `dash-shop.example.com`, `ws-shop.example.com`, `panel-shop.example.com` — and if you type a deeper name by hand the panel refuses it and shows you the spelling that works. There is no "turn the proxy off for this one" option, because a name with the proxy off publishes the address of your server. **If Cloudflare is not connected**, the card shows **This server's IP address (for the A records)** with a copy button. Copy that number, and at your domain provider create a DNS **A record**: | Field | What to enter | |---|---| | Type | `A` | | Name / Host | the part before your domain (`shop`), or `@` for the domain itself | | Value / Points to | the IP address you copied | | TTL | leave the default | Then press **Re-check** on that row, or **Re-check DNS** at the top of the page. **Expected result:** the chip turns to **pointed**. DNS changes are not instant. A few minutes is normal, and some providers take longer. The row tells you what the name currently resolves to, so you can see the change arrive. ## 3. Get HTTPS Press **Get free SSL** on the row. The button stays disabled until the name is pointed. The panel checks DNS again, asks Let's Encrypt for a certificate, writes the web server configuration and reloads it. You watch the log as it runs. It takes under a minute. **Expected result:** the chip turns to **secured**, and `https://your-domain` opens with a padlock. There are two ways the panel can prove to Let's Encrypt that the name is yours, and it picks the better one automatically: - **Through Cloudflare (DNS-01).** When a stored Cloudflare token manages the name's zone, the panel proves control by writing a temporary DNS record. This needs no port 80 at all, works with the orange cloud on, and produces a real certificate that satisfies Cloudflare's strictest setting. - **Over port 80 (HTTP-01).** Otherwise Let's Encrypt fetches a file from your server over plain `http`, so port **80** has to be reachable. The log says which one ran. Renewal is automatic: a daily job renews every certificate before it expires, and the web server is reloaded for each one separately, so one certificate with a problem can never freeze the others. There is nothing to remember and nothing to pay. --- ## If you use Cloudflare Every record the panel creates is **proxied** — that is the whole point of having Cloudflare there, and it is not optional in this panel. Press **Get free SSL** as normal and the panel handles the rest: - **The usual case.** With a Cloudflare token connected, it gets a real Let's Encrypt certificate by writing a DNS record, straight through the proxy. Set Cloudflare's SSL/TLS mode to **Full (strict)**. - **Without a token**, it first tries for a real certificate through the proxy over port 80. If that cannot pass on your zone, it installs a certificate the server signs itself, for the Cloudflare-to-server leg only. Your visitors still get Cloudflare's own trusted certificate. Set Cloudflare's SSL/TLS mode to **Full** — not **Full (strict)**. The panel tells you which of the three happened, in the log and on the page. Connecting a token is worth the five minutes: it removes the self-signed case entirely. **Keep one group consistent.** One certificate serves one mode, so all the names of one card must be either all proxied or all direct — not a mix. The panel says so and leaves the odd one out of the certificate rather than breaking the rest. --- ## Adding more names to one project Add as many as you like to a card, and give each one its own certificate with **Get free SSL**. A common pair is `example.com` and `www.example.com`. **Make primary** changes which name is the main one. For the admin site, the primary is the address the app and the mobile apps switch to, so change it only when you mean it. **Remove** takes a name off this server. Visitors using it stop reaching the site. The name itself still belongs to you at your provider. The admin site's primary name cannot be removed — replace it instead. A newly added name has no certificate until you press **Get free SSL** for that name. --- ## How to check it worked - The row shows all three chips: **added**, **pointed**, **secured**. - `https://your-domain` opens with a padlock and no warning. - **Server → Health** shows no certificate problems. - `sudo sixpanel ssl status` lists the certificate, its issuer and the days left. ## If it went wrong **"does not resolve to \"** The A record is missing, wrong, or has not spread yet. Fix it, wait a few minutes, press **Get free SSL** again. **The certificate step times out** When the panel is using the port-80 method, port **80** must be open to the internet — or, behind Cloudflare, to Cloudflare's addresses. See **[The three ports](https://www.allsweb.com/sixpanel/docs/firewall)**. Connecting a Cloudflare token removes this dependency altogether. **"ACME_EMAIL is not set" / the log says the email address is unusable** Let's Encrypt needs a real email address. Set it under **Settings**, then try again. Without one the panel can only write a self-signed certificate. **Cloudflare error 526 (Invalid SSL certificate)** Your zone is set to **Full (strict)** but the server is using a self-signed certificate. Either press **Get free SSL** again — if the check can pass now, the panel upgrades to a real certificate by itself — or set the zone to **Full**. **The panel refused a name and suggested a different spelling** That name would sit more than one level below your Cloudflare domain, where the free Cloudflare certificate does not reach. Use the spelling the panel offers (`dash-shop.example.com` rather than `dash.shop.example.com`). **"too many certificates"** Let's Encrypt limits how many certificates one set of names may get per week. Wait, or use a slightly different set of names. **The panel's own address** Giving the panel its own domain is a different setting, on the **Security** page. Read the lock-out warning in **[First login](https://www.allsweb.com/sixpanel/docs/first-login)** before you use it. More causes and fixes: **[When something is broken](https://www.allsweb.com/sixpanel/docs/troubleshooting)**.