BillionMail SSL certificate and hostname fix (Let's Encrypt "connection refused" and HELO localhost)
Two fixes every new BillionMail server on aaPanel should get: a real SSL certificate for the dashboard and mail connections, and the correct server name in Postfix. We hit both problems on our own install, so here's exactly what happened and how we fixed them.
Part 1: Free SSL with Let's Encrypt
Before you start: your mail server name (e.g. bm.example.com) must have an A record pointing to the server, and in Cloudflare it must be DNS only (grey cloud).
In BillionMail, open Settings > Common Settings, scroll to SSL Certificate Configuration and click Apply Certificate. BillionMail requests a Let's Encrypt certificate for the hostname.
![[Image: attachment.php?aid=417]](https://adminsforum.com/attachment.php?aid=417)
If it works: you'll see "Certificate Valid" with an expiry date about 90 days away. BillionMail renews it automatically. Reload the dashboard and the browser warning is gone.
If it fails with "connection refused": that's what happened to us. The error looks like:
Why it fails
Let's Encrypt proves you own the name by visiting your server on plain HTTP, port 80. On our aaPanel install, BillionMail's web server was listening on port 8080 instead, so nothing answered on port 80.
The fix: give BillionMail port 80
Check first: port 80 must be free. If aaPanel's Nginx or Apache already serves websites on this server, changing this will clash with them. On a dedicated mail server, it's fine.
On the server, as root:
docker compose up -d recreates the containers with the new port. Then click Apply Certificate again. This time it worked for us straight away.
Also open port 80 in aaPanel's Security page and in your provider's firewall if it's closed.
Keep the private key private. The SSL page shows the private key in a text box. Never paste it into a forum post or a screenshot; anyone with it can impersonate your server.
Part 2: Fix the HELO name (myhostname)
When your server delivers mail, it introduces itself to the receiving server by name. That's called the HELO. If it says localhost or a random container name, spam filters treat it as a badly configured spam bot. On our first spam test, this alone cost us more than 3 points.
Check what Postfix uses:
It should show your mail server name, e.g. myhostname = bm.example.com.
Fix it if it doesn't:
Run the postconf myhostname check again.
Why "force-recreate"? The config file is mounted into the container as a single file. When we edited it, a plain restart didn't pick up the change; recreating the container did. Also check that BILLIONMAIL_HOSTNAME in the .env file is your mail server name, so the setting survives updates.
Three names that must agree
For the best deliverability, these three should all be the same name, e.g. bm.example.com:
Check your work
Send a test email from BillionMail to a free email tester like SEOStackTools Email Tester and look at the reverse DNS and header checks. See our guide BillionMail deliverability: test and fix.
More BillionMail how-to guides
Tested on BillionMail 4.9.0 through aaPanel, October 2026. Sources: Let's Encrypt: challenge types (HTTP-01 uses port 80) · Postfix: myhostname.
Two fixes every new BillionMail server on aaPanel should get: a real SSL certificate for the dashboard and mail connections, and the correct server name in Postfix. We hit both problems on our own install, so here's exactly what happened and how we fixed them.
Part 1: Free SSL with Let's Encrypt
Before you start: your mail server name (e.g. bm.example.com) must have an A record pointing to the server, and in Cloudflare it must be DNS only (grey cloud).
In BillionMail, open Settings > Common Settings, scroll to SSL Certificate Configuration and click Apply Certificate. BillionMail requests a Let's Encrypt certificate for the hostname.
If it works: you'll see "Certificate Valid" with an expiry date about 90 days away. BillionMail renews it automatically. Reload the dashboard and the browser warning is gone.
If it fails with "connection refused": that's what happened to us. The error looks like:
Code:
Failed to apply for SSL certificate ... urn:ietf:params:acme:error:connection ::
Fetching http://bm.example.com/.well-known/acme-challenge/... : Connection refusedWhy it fails
Let's Encrypt proves you own the name by visiting your server on plain HTTP, port 80. On our aaPanel install, BillionMail's web server was listening on port 8080 instead, so nothing answered on port 80.
The fix: give BillionMail port 80
Check first: port 80 must be free. If aaPanel's Nginx or Apache already serves websites on this server, changing this will clash with them. On a dedicated mail server, it's fine.
On the server, as root:
Code:
cd /www/dk_project/dk_app/billionmail/billionmail_XXXX # your folder name
grep HTTP_PORT .env
cp .env .env.bak
sed -i 's/^HTTP_PORT=.*/HTTP_PORT=80/' .env
docker compose up -dAlso open port 80 in aaPanel's Security page and in your provider's firewall if it's closed.
Keep the private key private. The SSL page shows the private key in a text box. Never paste it into a forum post or a screenshot; anyone with it can impersonate your server.
Part 2: Fix the HELO name (myhostname)
When your server delivers mail, it introduces itself to the receiving server by name. That's called the HELO. If it says localhost or a random container name, spam filters treat it as a badly configured spam bot. On our first spam test, this alone cost us more than 3 points.
Check what Postfix uses:
Code:
docker ps --format "{{.Names}}" | grep postfix
docker exec POSTFIX_CONTAINER_NAME postconf myhostnameFix it if it doesn't:
Code:
cd /www/dk_project/dk_app/billionmail/billionmail_XXXX
cp conf/postfix/main.cf conf/postfix/main.cf.bak
sed -i 's/^myhostname = .*/myhostname = bm.example.com/' conf/postfix/main.cf
docker compose up -d --force-recreate postfix-billionmailWhy "force-recreate"? The config file is mounted into the container as a single file. When we edited it, a plain restart didn't pick up the change; recreating the container did. Also check that BILLIONMAIL_HOSTNAME in the .env file is your mail server name, so the setting survives updates.
Three names that must agree
For the best deliverability, these three should all be the same name, e.g. bm.example.com:
- The A record of the name, pointing to your server's IP.
- The PTR (reverse DNS) of the IP, pointing back to the name (set by your VPS provider).
- The HELO / myhostname your Postfix uses.
Check your work
Send a test email from BillionMail to a free email tester like SEOStackTools Email Tester and look at the reverse DNS and header checks. See our guide BillionMail deliverability: test and fix.
More BillionMail how-to guides
- Send API for transactional email
- WordPress email through BillionMail SMTP
- Import contacts, groups and tags
- Email templates explained
- SMTP relay with Amazon SES, Brevo or Mailgun
- Mailboxes and webmail
- Campaign analytics explained
- IP warm-up plan
- Move from Mailchimp or Sendy
- Add a second sending domain
Tested on BillionMail 4.9.0 through aaPanel, October 2026. Sources: Let's Encrypt: challenge types (HTTP-01 uses port 80) · Postfix: myhostname.