Install a Let’s Encrypt certificate in Virtualmin from Manage Virtual Server → Setup SSL Certificate → SSL Providers. Before requesting it, make sure the domain’s DNS A and AAAA records point to the Virtualmin server and that the public internet can reach the correct Apache or Nginx virtual host. Select Let’s Encrypt, include every hostname and alias the certificate must cover, enable automatic renewal, run the connectivity check, and request the certificate. Then test the site at https://yourdomain.com and, if needed, turn on the HTTP-to-HTTPS redirect.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What you need before requesting a certificate
Let’s Encrypt validation is an internet-facing check. Virtualmin can submit the request, but the certificate authority must resolve each requested hostname and reach the web server that answers for it. Fix DNS and virtual-host routing before opening the certificate screen; otherwise the request will fail regardless of the setting you choose in Virtualmin.
As an Amazon Associate I earn from qualifying purchases.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Public DNS: The domain’s A record must point to the server’s IPv4 address, and its AAAA record must point to the correct IPv6 address if one is published. An incorrect AAAA record can break validation even when the A record is correct.
- Public reachability: The requested names must resolve from the public internet, and the server must accept the validation traffic on the web ports used by the site.
- Correct virtual host: Apache or Nginx must select the expected Virtualmin domain and document root for each hostname. A default site or another domain answering the request will cause validation to fail.
- Supported installation: Virtualmin’s automated installer assumes a fresh, supported operating system and DNS records that already point to the server.
- Virtualmin access: Use an administrator account that can manage the virtual server and its SSL settings.
Virtualmin initially creates a self-signed certificate. Browsers warn about self-signed certificates because they are not signed by a public certificate authority; replacing it with a Let’s Encrypt certificate removes that warning for a correctly configured public domain. A dedicated IP address is not required for modern SSL setups, according to Virtualmin’s documentation.
Certificate cost, validity, and renewal
Let’s Encrypt certificates are free, but they are intentionally short-lived. Virtualmin’s 2024 guide describes the typical validity period as 90 days. That is why a one-time request is not enough: automatic renewal must remain enabled and the renewed certificate must be loaded by the web server.
Renewal does not change which names are covered. Virtualmin renews the configured certificate for the virtual server, so an alias added after the original request should be added to the certificate request before the next renewal. Likewise, remove obsolete aliases or repair their DNS before renewal; an invalid name in the configured list can prevent the renewal request from completing.
There is no requirement to buy a dedicated address or a paid certificate for a normal public Virtualmin site. The practical costs are the server, DNS service, and administration needed to keep the names publicly resolvable and the web service available.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsUI or command line: which installation method fits?
Both methods use Virtualmin’s certificate management. The web interface is the simplest choice when you want to review aliases and use an interactive preflight check. The API is useful for repeatable administration, explicit hostname lists, and scripted renewal configuration.
| Decision point | Virtualmin interface | Virtualmin API |
|---|---|---|
| Ease of use | Point-and-click workflow under the virtual server’s SSL settings | Shell command with options supplied explicitly |
| Hostname control | Keep the main domain and aliases, then add names in the additional-domain field | Repeat --host name for each required hostname |
| Preflight validation | Use Check connectivity first when it is available | Add --check-first |
| Renewal configuration | Enable Automatically renew certificate | Add --renew |
| Wildcard eligibility | Available only when Virtualmin controls the DNS zone | Use the interface’s DNS-controlled workflow when a wildcard is required |
Install Let’s Encrypt from the Virtualmin interface
- Sign in. Log in to Virtualmin with an administrator account.
- Select the domain. In the left-hand server list, choose the virtual server you want to secure.
- Open the certificate screen. Go to Manage Virtual Server → Setup SSL Certificate.
- Open the provider list. Select the SSL Providers tab. This is where Virtualmin exposes Let’s Encrypt as a certificate provider.
- Review the requested names. Leave the main domain and its existing aliases selected. Add every additional hostname that visitors will use and that should appear in the certificate. Include names such as a separate
wwwalias only if that alias actually resolves to this server and serves the site. - Choose Let’s Encrypt. Select Let’s Encrypt as the SSL certificate provider.
- Turn on renewal. Enable Automatically renew certificate. Virtualmin’s 2024 guide describes these free certificates as having a typical 90-day validity period, so leaving renewal enabled avoids a certificate expiring between manual maintenance windows.
- Run the preflight check. Select Check connectivity first when the option is shown. This lets Virtualmin test whether the names can be reached before it sends the request.
- Request the certificate. Click Request Certificate and wait for Virtualmin to finish updating the certificate and web-server configuration.
- Test the result. Open
https://yourdomain.comin a browser and inspect the certificate details. Test every important alias, not just the primary domain.
If the site still opens over plain HTTP, enable the redirect at Web Configuration → Website Options. The redirect changes HTTP requests to HTTPS; it does not issue or renew a certificate, so perform the certificate request first.
Choose the exact hostnames the certificate will cover
Main domain and aliases
Virtualmin normally requests the main domain and its configured aliases. A certificate for example.com does not automatically cover www.example.com, an administrative subdomain, or any other name unless that name is included in the request. Add additional names in the certificate request form and verify that each one has DNS pointing to this Virtualmin server.
Do not add a hostname merely because you might use it later. Every requested name must pass validation now. Remove stale aliases or correct their DNS before requesting, otherwise one unreachable name can prevent the certificate from being issued for all of them.
Wildcard certificates
The Also request wildcard certificate option can cover subdomains, but Virtualmin makes it available only when it controls the domain’s DNS zone. Wildcard validation uses DNS records: Virtualmin must be able to create temporary validation records in that zone. If DNS is hosted elsewhere, the wildcard option will not work through this Virtualmin-managed process; use individually validated hostnames or move DNS control to a configuration Virtualmin can manage.
A wildcard does not replace the need to secure the base domain. Request the apex name as well when visitors will use it, and ensure the DNS zone contains the records required for both the apex and subdomains.
Install or renew from the command line
Request a certificate and configure renewal
Virtualmin provides the generate-letsencrypt-cert API program. For a domain named example.com, run:
virtualmin generate-letsencrypt-cert --domain example.com --check-first --renewThe options have distinct jobs:
--domain example.comidentifies the Virtualmin virtual server.--check-firstasks Virtualmin to verify external connectivity before it requests the certificate.--renewconfigures automatic renewal near expiry.
When the certificate must cover an explicit list of names, repeat --host for each one. For example:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
virtualmin generate-letsencrypt-cert --domain example.com --host example.com --host www.example.com --host shop.example.com --check-first --renewUse only hostnames that resolve to this server and are configured as part of the virtual server. The command’s preflight check can identify reachability problems, but it cannot correct DNS or a misrouted web-server configuration.
Renew an existing certificate manually
If automatic renewal is already configured, Virtualmin handles renewal near expiration. To force the same certificate-generation workflow from a shell, run the command again with --renew and the relevant domain and host options. Check the resulting HTTPS service afterward; renewal is not complete until the web server is serving the new certificate.
For repeat administration, keep the domain and host list explicit in your script or command history. That makes it easier to spot a newly added alias that is not yet covered, while --check-first provides the same connectivity safeguard as the interface.
Install a certificate issued somewhere else
Let’s Encrypt is not the only certificate source. If a certificate was issued outside Virtualmin, use the Update Certificate and Key tab in the SSL setup screen, or run:
virtualmin install-cert --domain example.com --cert /path/fullchain.pem --key /path/privkey.pem --ca /path/ca.pem--cert supplies the server certificate, --key supplies its private key, and --ca supplies the certificate-authority chain when one is provided separately. The install-cert program checks the certificate and key format and verifies that they match before changing the web-server configuration. If validation fails, Virtualmin stops before applying the update.
After an imported certificate is accepted, perform the same browser checks as for a Let’s Encrypt certificate. Confirm that the hostname is listed, the intended virtual host answers, and the web server is actually presenting the new certificate rather than an older one.
Verify HTTPS after installation
Check the browser result
- Open the primary address with an explicit
https://prefix. - Inspect the browser’s certificate information and confirm that the certificate names include the hostname in the address bar.
- Open each configured alias over HTTPS, including any
wwwname or application subdomain you requested. - Open an HTTP URL and confirm that it redirects to the matching HTTPS URL if you enabled the Website Options redirect.
Check the server-side mapping
If one hostname shows another site, the certificate may be valid while the virtual-host routing is wrong. Review the Apache or Nginx virtual-host definition and the Virtualmin domain’s document root. The hostname, SSL listener, and document root must all point to the intended virtual server.
When an alias is not covered, return to Manage Virtual Server → Setup SSL Certificate → SSL Providers, add the missing name, and request an updated certificate. A redirect cannot make an uncovered hostname valid.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallTroubleshoot a failed Let’s Encrypt validation
DNS does not resolve to this server
Check the A record first, then check the AAAA record if the domain publishes IPv6. Both records must identify the Virtualmin server that hosts the site. If an AAAA record points to an old or unreachable machine, validation may follow IPv6 and fail even though IPv4 appears healthy. Correct the record and wait for the change to propagate before retrying.
The name is not publicly reachable
Validation cannot complete for a private-only name, a name blocked by a firewall, or a server that cannot be reached on the required web ports. Test the public hostname from a network outside the server’s local environment. Confirm that the DNS name resolves publicly and that the web service answers for it.
The wrong Apache or Nginx virtual host answers
When the request reaches a default virtual host, the wrong domain, or the wrong document root, the certificate authority receives unexpected content. Check the virtual-host configuration and the domain’s document root. Make sure the requested hostname is configured in Virtualmin and that the web server has reloaded the relevant configuration.
A wildcard request is rejected
Confirm that Virtualmin controls the DNS zone. Wildcard issuance requires DNS validation records, and the documented wildcard option is available only when Virtualmin can add those temporary records. If DNS is managed by another provider, request each reachable hostname separately or use a DNS arrangement that Virtualmin can manage.
Free tools Windows power users keep installed
One-click scans. No signup required.
The initial server-hostname certificate failed
During initial installation, Virtualmin may fail to obtain a certificate for the server hostname when that hostname does not resolve publicly or the ports are unreachable. Virtualmin still allows login at the server IP, although the browser will show a warning. Fix the hostname’s DNS and reachability, then request the certificate afterward from the appropriate virtual-server SSL settings.
An imported certificate will not install
For certificates issued elsewhere, confirm that the PEM files are complete and that the private key belongs to the certificate. Use virtualmin install-cert or the Update Certificate and Key tab. Virtualmin checks the format and certificate/key match before updating the web-server configuration, so a failure at this stage indicates an input problem rather than a partially applied configuration.
Only one alias fails
If the main domain works but an alias does not, treat that alias as a separate DNS and virtual-host problem. Verify its A and AAAA records, confirm that it is listed in the certificate request, and check that Apache or Nginx routes the alias to the same document root. Re-request the certificate only after the alias is publicly reachable.
Operational checklist
- Point the domain’s A and, when used, AAAA records at the Virtualmin server.
- Confirm the hostname resolves and the expected site is publicly reachable.
- Verify Apache or Nginx selects the correct virtual host and document root.
- Open Manage Virtual Server → Setup SSL Certificate → SSL Providers.
- Include the main domain, valid aliases, and any additional names that must be covered.
- Use the wildcard option only when Virtualmin controls DNS.
- Select Let’s Encrypt and enable automatic renewal.
- Run Check connectivity first or use
--check-firstfrom the API. - Request the certificate and test every HTTPS hostname.
- Enable the HTTP-to-HTTPS redirect under Web Configuration → Website Options if the entire site should use HTTPS.
- For command-line administration, use
--renewso renewal remains configured near the certificate’s expiration.
How the UI and API choices affect maintenance
The interface is preferable for a one-off setup because it exposes the current aliases, the provider selector, the wildcard restriction, and the connectivity check in one place. It also reduces the chance of omitting a hostname when the virtual server already has aliases configured.
The API is preferable when you manage several domains or want a repeatable procedure. Explicit --host arguments make the certificate’s name list visible in shell history or automation, while --check-first and --renew preserve the same two safety controls available in the interface. In either method, DNS ownership and public reachability remain prerequisites; no command-line option can compensate for a wrong A/AAAA record or a misdirected virtual host.
Frequently asked questions
Where is the SSL Providers tab in Virtualmin?
Select the virtual server, open Manage Virtual Server → Setup SSL Certificate, and then choose SSL Providers. The Let’s Encrypt provider and the hostname fields are on that tab.
How do I force a Virtualmin site to use HTTPS?
First issue and verify the certificate. Then go to Web Configuration → Website Options and enable the HTTP-to-HTTPS redirect. The redirect affects future HTTP requests but cannot fix DNS, certificate-name, or virtual-host errors.
Does Let’s Encrypt require a dedicated IP?
No. Virtualmin’s documentation states that modern SSL setups do not require a dedicated IP per domain. The domain still needs publicly correct DNS and a reachable web server.
Recommended Free Tools
Why did validation fail when the A record is correct?
Check for an incorrect AAAA record, blocked web ports, private DNS, or a default Apache or Nginx virtual host answering instead of the requested Virtualmin site. Validation follows the publicly published DNS records, including IPv6.
Can I request a wildcard certificate when DNS is hosted elsewhere?
Not through the documented Virtualmin-managed wildcard workflow. Virtualmin must control the DNS zone so it can create temporary DNS-validation records. Request individual names instead, or use DNS control that Virtualmin can manage.
How do I renew from the command line?
Use virtualmin generate-letsencrypt-cert with the domain, any required repeated --host options, --check-first, and --renew. Automatic renewal should remain enabled, and you should verify that the web server presents the renewed certificate.
What if the server hostname certificate cannot be issued during installation?
Virtualmin can still be accessed at the server IP with a browser warning. Make the hostname resolve publicly, ensure the web ports are reachable, and request the certificate after correcting those conditions.
What does an install-cert key mismatch mean?
It means the supplied private key does not match the certificate, or one of the PEM files is malformed or incomplete. Correct the files and retry; Virtualmin checks them before changing the web-server configuration.
Frequently Asked Questions
Where is the SSL Providers tab in Virtualmin?
Select the virtual server, open Manage Virtual Server → Setup SSL Certificate, and choose SSL Providers.
How do I force my Virtualmin site to use HTTPS?
Issue and verify the certificate, then enable the HTTP-to-HTTPS redirect under Web Configuration → Website Options.
Why does Let’s Encrypt validation fail in Virtualmin?
Verify public A and AAAA records, reachability on the web ports, and Apache or Nginx virtual-host routing. An incorrect AAAA record or default virtual host can fail validation.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →How do I renew a Virtualmin Let’s Encrypt certificate from the command line?
Run virtualmin generate-letsencrypt-cert with the domain, repeated –host options as needed, –check-first, and –renew.
Does Let’s Encrypt require a dedicated IP in Virtualmin?
No. Virtualmin states that modern SSL setups do not require a dedicated IP per domain.
Can Virtualmin issue a wildcard certificate if another provider hosts DNS?
The documented wildcard workflow requires Virtualmin-controlled DNS so temporary validation records can be created.
The Bottom Line
For a reliable Virtualmin Let’s Encrypt setup, correct DNS and public reachability come first. Use Manage Virtual Server → Setup SSL Certificate → SSL Providers, include every valid hostname, enable automatic renewal, run the connectivity check, and verify each HTTPS alias after issuance. Use --check-first and --renew for repeatable command-line administration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
