Let's Encrypt SSL and forcing HTTPS

HTTPS is mandatory for any modern website — Google penalizes HTTP sites in the search results, browsers warn with “Not secure”. Plesk makes it easy: one click and you have a valid Let’s Encrypt certificate. Here’s how.

Rolling out a Let’s Encrypt certificate

In Plesk: Domain → Hosting & DNS → SSL/TLS Certificates.

Click “Install Let’s Encrypt”:

• Domain selection: main domain plus optionally www.deinedomain.de, mail server mail.deinedomain.de, webmail webmail.deinedomain.de
• Email: for expiry notices from Let’s Encrypt
• Wildcard: enable if you want *.deinedomain.de (all subdomains)
• Auto-renewal: enable (default)

Click Get it free → the certificate is requested, validated, installed. Takes 30-60 seconds.

After that, your domain is reachable via https:// with a valid green padlock.

Wildcard certificate

For *.deinedomain.de (all subdomains in one certificate):

• enable the wildcard option
• Plesk validates via a DNS challenge (TXT record) — works automatically because our DNS server is integrated with Plesk

Advantage: one certificate for all current and future subdomains, no separate issuing per subdomain.

Auto-renewal

Let’s Encrypt certificates are valid for 90 days. Plesk renews automatically every 60 days.

You don’t have to do anything. If a renewal fails, you get a notification (e.g. when the domain points to the wrong IP).

Redirecting HTTP to HTTPS

Once HTTPS is active, you’ll normally want all HTTP requests redirected to HTTPS automatically. Plesk makes it simple:

In Hosting & DNS, check Permanent SEO-safe 301 redirect from HTTP to HTTPS.

Takes effect immediately. Anyone opening http://deinedomain.de gets redirected to https://deinedomain.de.

Manually via .htaccess (alternative)

If the Plesk toggle doesn’t fit (e.g. a custom setup): in /httpdocs/.htaccess:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Enabling HSTS

HTTP Strict Transport Security tells browsers: “always use HTTPS for this domain, even on the first visit”.

In Plesk → Hosting & DNS → SSL → enable HSTS.

Important: only enable it once HTTPS runs stably. HSTS is unforgiving — if HTTPS breaks later, visitors can’t get through at all.

Checking the certificate manually

In the browser: padlock icon → Show certificate.

It should show:

• Issuer: Let’s Encrypt
• Valid from / to (typically 90 days)
• Subject Alternative Names (all domains the cert covers)

Via CLI:

openssl s_client -connect deinedomain.de:443 -servername deinedomain.de < /dev/null

Installing your own certificate

If you have an EV certificate or a commercial cert (e.g. from Sectigo, GeoTrust):

In Plesk → SSL/TLS Certificates → + Add SSL/TLS Certificate:

• private key (PEM format)
• certificate (PEM)
• CA bundle (intermediate chain)

Save, then select it in the hosting settings instead of Let’s Encrypt.

Use case: some compliance requirements (banks, public authorities) demand EV. For 99% of websites, Let’s Encrypt is enough.

Pitfalls

”Let’s Encrypt validation failed”

Plesk validates via an HTTP challenge (a file in /httpdocs/.well-known/). If that fails:

• the domain doesn’t point to our IP yet (DNS propagation can take 24 hours)
• .htaccess blocks the /.well-known/ path
• the subdomain isn’t in Plesk’s DNS

Fix: wait 24 hours, or open a ticket.

”Mixed content” after enabling HTTPS

WordPress loads some resources via http:// (old plugins, custom themes). The browser console shows “mixed content” warnings.

Fix:

• WP admin → Settings → General → set both site URL and WordPress address to https://
• The Better Search Replace plugin for http:// → https:// in the database
• The WordPress Toolkit has a “Force HTTPS” mode that fixes this automatically

Wildcard certificate not valid for all subdomains

A wildcard *.deinedomain.de only covers the first subdomain level. So blog.deinedomain.de yes, but test.blog.deinedomain.de no.

For deeper nesting: a separate certificate or a domain-specific wildcard.

Mail server certificate doesn’t match

If you run mail under mail.deinedomain.de, then mail.deinedomain.de has to be included in the certificate — otherwise browser warnings in webmail.

Fix: use a wildcard, or check all relevant subdomains when issuing.

Frequently asked questions

Does Let’s Encrypt cost extra? No, it’s included in the webhosting plan — we charge nothing for it.

How long does SSL activation take? 30-60 seconds after the click. The browser cache may need a hard reload (Ctrl+Shift+R).

Can I do SSL per subdomain separately? Default: the wildcard or multi-SAN certificate covers the main domain plus enabled subdomains. Per-subdomain certificates are possible, but needlessly complicated.

What if my domain is with another provider (external DNS)? Let’s Encrypt validation works via the HTTP challenge → as long as the domain points to our IP, it works. Switching nameservers to us is not required.

Renewal fails — what now? Plesk sends a notification. Common causes: domain pointing to the wrong IP, an .htaccess block, rate limiting (>5 renewals per domain per week).

Fix: open a ticket, we’ll check.

The browser shows “connection not secure” despite an active certificate. Browser cache problem. Hard reload (Ctrl+Shift+R / Cmd+Shift+R).

Can I get SSL for mail (IMAP/SMTP) via Let’s Encrypt too? If mail.deinedomain.de is in your certificate: yes. Plesk configures IMAP/SMTP with the cert automatically.

What does an “A+” rating at SSL Labs mean? ssllabs.com/ssltest tests your SSL config. The standard Plesk setup scores B or A. A+ takes HSTS settings, OCSP stapling, more modern cipher suites — we’ll configure that on request.

What’s next

• Domain overview and web space
• WordPress Toolkit in Plesk
• Creating a mailbox