[JAY]

BillionMail SSL certificate won't apply: fix Let's Encrypt errors

You click Apply Certificate under Settings > Common Settings and get a red box full of error text instead of a green "Certificate Valid". This guide explains the common Let's Encrypt errors in plain language and how to fix each one. For the basic setup, see BillionMail SSL and hostname fix first.

How Let's Encrypt checks your server
Before it issues a free certificate, Let's Encrypt visits your mail host name (for example

Code:Copy

bm.example.com

) on plain HTTP, port 80, and looks for a temporary file BillionMail creates. If it can't reach that file, you get an error. So almost every SSL problem comes down to one question: does port 80 on that name reach BillionMail?

This is the real error from our test server (host and IP replaced):

Code:Copy

Failed to apply for SSL certificate: error: one or more domains had a problem: [bm.example.com] invalid authorization: acme: error: 400 :: urn:ietf:params:acme:error:connection :: YOUR_IP: Fetching http://bm.example.com/.well-known/acme-challenge/...: Connection refused

Read it from the end:

Code:Copy

Fetching http://bm.../.well-known/acme-challenge/...: Connection refused

. That last part tells you what went wrong.

What the error means

• Connection refused: the server is reachable, but nothing listens on port 80. On aaPanel installs, BillionMail often runs its web interface on another port (ours was on 8080).
  
• Timeout during connect: something blocks port 80: aaPanel's Security page, your provider's firewall, or a DNS record pointing to the wrong IP.
  
• DNS problem: NXDOMAIN or no valid A records: the name has no A record yet, or you typed it differently.
  
• Invalid response / 404 / unauthorized: another web server answered on port 80, usually aaPanel's own Nginx or Apache, or Cloudflare's proxy.
  
• Too many certificates already issued: Let's Encrypt rate limits. You requested the same certificate too many times; wait (up to a week) and stop retrying.
  
• CAA record prevents issuance: your domain has a CAA record that doesn't allow Let's Encrypt. Add
  Code:Copy

  0 issue "letsencrypt.org"
  or remove the CAA record.
  

Step 1: Check the DNS

Code:Copy

dig +short A bm.example.com curl -4 -s https://ifconfig.me ; echo

Both must show the same IP. In Cloudflare, the record must be DNS only (grey cloud); an orange cloud sends Let's Encrypt to Cloudflare instead of your server. New records can take a few minutes to an hour to spread.

Step 2: Check who answers on port 80
On the server:

Code:Copy

ss -tlnp | grep -E ':80 |:8080 '

• No line with
  Code:Copy

  :80
  : nothing listens there ("connection refused").
  
• Code:Copy

  nginx
  or
  Code:Copy

  httpd
  on :80: aaPanel's web server owns port 80 ("404 / unauthorized").
  
• Code:Copy

  docker-proxy
  on :80: BillionMail has it. Good.
  

Then test from outside (your own computer):

Code:Copy

curl -I http://bm.example.com/

A timeout here, while the server shows something listening, means a firewall is in the way.

Step 3: Give BillionMail port 80
In your BillionMail folder:

Code:Copy

cd /www/dk_project/dk_app/billionmail/billionmail_XXXX # your folder grep -E '^HTTP_PORT|^HTTPS_PORT' .env cp .env .env.bak sed -i 's/^HTTP_PORT=.*/HTTP_PORT=80/' .env docker compose up -d

Code:Copy

docker compose up -d

recreates the containers with the new port. Then open port 80 in aaPanel's Security page and click Apply Certificate again.

If aaPanel's web server already uses port 80 for your websites, BillionMail can't have it too. Your choices:

• Best: run BillionMail on its own small VPS. Mail servers and websites are easier to keep healthy apart.
  
• Run BillionMail behind aaPanel's web server as a reverse proxy. BillionMail's GitHub has a REVERSE_PROXY.md document for this. It takes more work and you must keep it in mind on every update.
  
• Stopping aaPanel's web server just to apply the certificate works once, but renewal (about every 60 days) will fail the same way. Not recommended.
  

Step 4: After it works
You should see Certificate Valid with an expiry date about 90 days away. BillionMail renews it automatically, as long as port 80 stays reachable. Reload the dashboard; the browser warning is gone. Mail apps connecting on 993, 465 and 587 should then see a trusted certificate too.

Keep the private key private. The SSL page shows the private key in a text box. Never post it on a forum or in a screenshot.

Still failing?
Post in this section with the last line of the error, the output of

Code:Copy

ss -tlnp | grep -E ':80 '

and whether you use Cloudflare. Hide your IP if you prefer.

Sources: Let's Encrypt: challenge types · Let's Encrypt: rate limits · Let's Encrypt: CAA


More BillionMail troubleshooting

• Port 25 blocked: emails not sending
  
• DKIM fails although the record exists
  
• Emails stuck in the send queue
  
• Can't open the dashboard
  
• Webmail (Roundcube) problems
  
• Emails going to spam
  
• Update safely and roll back
  

Applies to BillionMail 4.9 installed through aaPanel or the install script, October 2026.