Guide BillionMail SSL and Hostname Fix: Let's Encrypt and HELO localhost - Printable Version +- AdminsForum (https://adminsforum.com) +-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels) +--- Forum: aaPanel (https://adminsforum.com/Forum-aapanel) +---- Forum: aaPanel Guides & Tutorials (https://adminsforum.com/Forum-aapanel-guides-tutorials) +----- Forum: aaPanel BillionMail Guides (https://adminsforum.com/Forum-aapanel-billionmail-guides) +----- Thread: Guide BillionMail SSL and Hostname Fix: Let's Encrypt and HELO localhost (/Thread-guide-billionmail-ssl-and-hostname-fix-let-s-encrypt-and-helo-localhost)

BillionMail SSL and Hostname Fix: Let's Encrypt and HELO localhost - JAY - 10-21-2026 BillionMail SSL certificate and hostname fix (Let's Encrypt "connection refused" and HELO localhost) Two fixes every new BillionMail server on aaPanel should get: a real SSL certificate for the dashboard and mail connections, and the correct server name in Postfix. We hit both problems on our own install, so here's exactly what happened and how we fixed them. Part 1: Free SSL with Let's Encrypt Before you start: your mail server name (e.g. bm.example.com) must have an A record pointing to the server, and in Cloudflare it must be DNS only (grey cloud). In BillionMail, open Settings > Common Settings, scroll to SSL Certificate Configuration and click Apply Certificate. BillionMail requests a Let's Encrypt certificate for the hostname. If it works: you'll see "Certificate Valid" with an expiry date about 90 days away. BillionMail renews it automatically. Reload the dashboard and the browser warning is gone. If it fails with "connection refused": that's what happened to us. The error looks like: Code:Copy Failed to apply for SSL certificate ... urn:ietf:params:acme:error:connection :: Fetching http://bm.example.com/.well-known/acme-challenge/... : Connection refused Why it fails Let's Encrypt proves you own the name by visiting your server on plain HTTP, port 80. On our aaPanel install, BillionMail's web server was listening on port 8080 instead, so nothing answered on port 80. The fix: give BillionMail port 80 Check first: port 80 must be free. If aaPanel's Nginx or Apache already serves websites on this server, changing this will clash with them. On a dedicated mail server, it's fine. On the server, as root: Code:Copy cd /www/dk_project/dk_app/billionmail/billionmail_XXXX # your folder name grep HTTP_PORT .env cp .env .env.bak sed -i 's/^HTTP_PORT=.*/HTTP_PORT=80/' .env docker compose up -d docker compose up -d recreates the containers with the new port. Then click Apply Certificate again. This time it worked for us straight away. Also open port 80 in aaPanel's Security page and in your provider's firewall if it's closed. Keep the private key private. The SSL page shows the private key in a text box. Never paste it into a forum post or a screenshot; anyone with it can impersonate your server. Part 2: Fix the HELO name (myhostname) When your server delivers mail, it introduces itself to the receiving server by name. That's called the HELO. If it says localhost or a random container name, spam filters treat it as a badly configured spam bot. On our first spam test, this alone cost us more than 3 points. Check what Postfix uses: Code:Copy docker ps --format "{{.Names}}" | grep postfix docker exec POSTFIX_CONTAINER_NAME postconf myhostname It should show your mail server name, e.g. myhostname = bm.example.com. Fix it if it doesn't: Code:Copy cd /www/dk_project/dk_app/billionmail/billionmail_XXXX cp conf/postfix/main.cf conf/postfix/main.cf.bak sed -i 's/^myhostname = .*/myhostname = bm.example.com/' conf/postfix/main.cf docker compose up -d --force-recreate postfix-billionmail Run the postconf myhostname check again. Why "force-recreate"? The config file is mounted into the container as a single file. When we edited it, a plain restart didn't pick up the change; recreating the container did. Also check that BILLIONMAIL_HOSTNAME in the .env file is your mail server name, so the setting survives updates. Three names that must agree For the best deliverability, these three should all be the same name, e.g. bm.example.com: The A record of the name, pointing to your server's IP. The PTR (reverse DNS) of the IP, pointing back to the name (set by your VPS provider). The HELO / myhostname your Postfix uses. Check your work Send a test email from BillionMail to a free email tester like SEOStackTools Email Tester and look at the reverse DNS and header checks. See our guide BillionMail deliverability: test and fix. More BillionMail how-to guides Send API for transactional email WordPress email through BillionMail SMTP Import contacts, groups and tags Email templates explained SMTP relay with Amazon SES, Brevo or Mailgun Mailboxes and webmail Campaign analytics explained IP warm-up plan Move from Mailchimp or Sendy Add a second sending domain Tested on BillionMail 4.9.0 through aaPanel, October 2026. Sources: Let's Encrypt: challenge types (HTTP-01 uses port 80) · Postfix: myhostname.