Guide BillionMail SSL Certificate Won't Apply: Fix Let's Encrypt Errors

Guide BillionMail SSL Certificate Won't Apply: Fix Let's Encrypt Errors - Printable Version

+- AdminsForum (https://adminsforum.com)
+-- Forum: Free & open-source control panels (https://adminsforum.com/Forum-free-open-source-control-panels)
+--- Forum: aaPanel (https://adminsforum.com/Forum-aapanel)
+---- Forum: aaPanel Guides & Tutorials (https://adminsforum.com/Forum-aapanel-guides-tutorials)
+----- Forum: aaPanel BillionMail Guides (https://adminsforum.com/Forum-aapanel-billionmail-guides)
+----- Thread: Guide BillionMail SSL Certificate Won't Apply: Fix Let's Encrypt Errors (/Thread-guide-billionmail-ssl-certificate-won-t-apply-fix-let-s-encrypt-errors)

BillionMail SSL Certificate Won't Apply: Fix Let's Encrypt Errors - JAY - 10-23-2026

BillionMail SSL certificate won't apply: fix Let's Encrypt errors

You click Apply Certificate under Settings > Common Settings and get a red box full of error text instead of a green "Certificate Valid". This guide explains the common Let's Encrypt errors in plain language and how to fix each one. For the basic setup, see BillionMail SSL and hostname fix first.

How Let's Encrypt checks your server
Before it issues a free certificate, Let's Encrypt visits your mail host name (for example

Code:

bm.example.com

) on plain HTTP, port 80, and looks for a temporary file BillionMail creates. If it can't reach that file, you get an error. So almost every SSL problem comes down to one question: does port 80 on that name reach BillionMail?

This is the real error from our test server (host and IP replaced):

Code:

Failed to apply for SSL certificate: error: one or more domains had a problem:
[bm.example.com] invalid authorization: acme: error: 400 ::
urn:ietf:params:acme:error:connection :: YOUR_IP: Fetching
http://bm.example.com/.well-known/acme-challenge/...: Connection refused

Read it from the end:

Code:

Fetching http://bm.../.well-known/acme-challenge/...: Connection refused

. That last part tells you what went wrong.

What the error means

Connection refused: the server is reachable, but nothing listens on port 80. On aaPanel installs, BillionMail often runs its web interface on another port (ours was on 8080).
Timeout during connect: something blocks port 80: aaPanel's Security page, your provider's firewall, or a DNS record pointing to the wrong IP.
DNS problem: NXDOMAIN or no valid A records: the name has no A record yet, or you typed it differently.
Invalid response / 404 / unauthorized: another web server answered on port 80, usually aaPanel's own Nginx or Apache, or Cloudflare's proxy.
Too many certificates already issued: Let's Encrypt rate limits. You requested the same certificate too many times; wait (up to a week) and stop retrying.
CAA record prevents issuance: your domain has a CAA record that doesn't allow Let's Encrypt. Add
Code:
0 issue "letsencrypt.org"
or remove the CAA record.

Step 1: Check the DNS

Code:

dig +short A bm.example.com
curl -4 -s https://ifconfig.me ; echo

Both must show the same IP. In Cloudflare, the record must be DNS only (grey cloud); an orange cloud sends Let's Encrypt to Cloudflare instead of your server. New records can take a few minutes to an hour to spread.

Step 2: Check who answers on port 80
On the server:

Code:

ss -tlnp | grep -E ':80 |:8080 '

No line with
Code:
:80
: nothing listens there ("connection refused").
Code:
nginx
or
Code:
httpd
on :80: aaPanel's web server owns port 80 ("404 / unauthorized").
Code:
docker-proxy
on :80: BillionMail has it. Good.

Then test from outside (your own computer):

Code:

curl -I http://bm.example.com/

A timeout here, while the server shows something listening, means a firewall is in the way.

Step 3: Give BillionMail port 80
In your BillionMail folder:

Code:

cd /www/dk_project/dk_app/billionmail/billionmail_XXXX   # your folder
grep -E '^HTTP_PORT|^HTTPS_PORT' .env
cp .env .env.bak
sed -i 's/^HTTP_PORT=.*/HTTP_PORT=80/' .env
docker compose up -d

Code:

docker compose up -d

recreates the containers with the new port. Then open port 80 in aaPanel's Security page and click Apply Certificate again.

If aaPanel's web server already uses port 80 for your websites, BillionMail can't have it too. Your choices:

Best: run BillionMail on its own small VPS. Mail servers and websites are easier to keep healthy apart.
Run BillionMail behind aaPanel's web server as a reverse proxy. BillionMail's GitHub has a REVERSE_PROXY.md document for this. It takes more work and you must keep it in mind on every update.
Stopping aaPanel's web server just to apply the certificate works once, but renewal (about every 60 days) will fail the same way. Not recommended.

Step 4: After it works
You should see Certificate Valid with an expiry date about 90 days away. BillionMail renews it automatically, as long as port 80 stays reachable. Reload the dashboard; the browser warning is gone. Mail apps connecting on 993, 465 and 587 should then see a trusted certificate too.

Keep the private key private. The SSL page shows the private key in a text box. Never post it on a forum or in a screenshot.

Still failing?
Post in this section with the last line of the error, the output of

Code:

ss -tlnp | grep -E ':80 '

and whether you use Cloudflare. Hide your IP if you prefer.

Sources: Let's Encrypt: challenge types · Let's Encrypt: rate limits · Let's Encrypt: CAA

More BillionMail troubleshooting

Applies to BillionMail 4.9 installed through aaPanel or the install script, October 2026.