<![CDATA[AdminsForum - aaPanel Domains, DNS & SSL Guides]]>

<![CDATA[AdminsForum - aaPanel Domains, DNS & SSL Guides]]> https://adminsforum.com/ Thu, 15 Oct 2026 07:04:50 +0000 MyBB <![CDATA[Install a Trusted SSL Certificate for the aaPanel Login]]> https://adminsforum.com/Thread-guide-install-a-trusted-ssl-certificate-for-the-aapanel-login Tue, 13 Oct 2026 11:33:04 +0800 DEV]]> https://adminsforum.com/Thread-guide-install-a-trusted-ssl-certificate-for-the-aapanel-login Quick answer
Use Settings → Panel SSL → Modify → Lets Encrypt to request a certificate for your panel hostname, then sign in through that same hostname. A website's SSL certificate does not automatically secure the separate aaPanel listener.

Lab result
On aaPanel 8.0.6, the native panel-certificate workflow deployed a trusted certificate for cp.adminslab.com. The panel keeps its existing port 18443. The certificate expires on 11 January 2027, and a client using its normal trusted CA store verified the hostname and negotiated TLS 1.3. The domain login succeeded.

.jpg

panel-cert-branded-20261013.jpg (Size: 53.76 KB / Downloads: 6)

1. Prepare DNS and recovery
Create a dedicated DNS-only A record pointing to the VPS before requesting the certificate. Use the existing panel port and keep its security entrance private. Our record is cp.adminslab.com → 217.217.235.82; substitute your own hostname and IP.
Keep an independent SSH or provider-console recovery route. Back up panel configuration and certificate files privately before replacing them. Do not put certificate private keys in a public web folder or attach them to a support thread.
If you use a CDN, redirection or validation rules, ensure they will not intercept the certificate challenge. This walkthrough used native File Verification and a DNS-only hostname.

2. Open the panel certificate editor
Open Settings and find Panel SSL. Select Modify next to SSL Certificate. This is the panel's certificate setting, separate from the SSL tab on an individual website.
Our panel already had HTTPS enabled with an IP certificate. We kept HTTPS enabled while replacing it with a hostname certificate; disabling encryption was unnecessary.

3. Select the native Let's Encrypt workflow
In Custom Panel Certificate choose Lets Encrypt. The native dialog offers File Verification and DNS Verification. We selected File Verification and entered cp.adminslab.com in Panel Domain, then used Install Certificate Now.
The request progressed through Panel SSL Initialize and deployed the certificate. Wait for the result instead of submitting repeated applications. A failed request needs its validation error checked first; repeated requests can encounter CA limits.
DNS Verification is an alternative when appropriate, but this article does not claim that its provider/API flow was tested.

4. Reconnect using the correct hostname
The panel may restart or refresh after certificate deployment. Use your domain, existing port and existing security entrance:

Code:

https://cp.example.com:YOUR_PANEL_PORT/YOUR_SECURITY_ENTRANCE

We opened the login page and signed in through the domain. The previous IP URL produced a certificate-name mismatch because the replacement certificate covers the domain. That is a hostname issue, not a reason to bypass a browser warning or disable HTTPS.
Domain binding remains a separate restriction. We left it empty; setting it is not required simply to install a domain certificate.

5. Verify the certificate
In Settings, check Certificate Status, Domain, Issuer and Expiration Date. The domain must match the address you actually use. Also test with normal certificate validation; a green status in the panel alone is not the entire check.

.jpg

panel-tls-proof-branded-20261013.jpg (Size: 61.42 KB / Downloads: 6)
Our independent check resolved the domain to the correct VPS, validated the chain and hostname, and negotiated TLS 1.3 on port 18443. It did not disable certificate validation.

6. Check renewal arrangements
The native workflow describes automatic renewal through the domain-management system. Our existing Domain SSL Renew task remains Running. Keep the hostname resolving to the correct server and keep the selected validation route working so future renewal can complete.
The present certificate was verified after deployment. Its future renewal has not yet occurred, so this guide does not claim a completed renewal test. Check the next renewal log and certificate expiry rather than assuming the task's existence guarantees success.
A manually copied Custom SSL certificate needs its own deployment and renewal process. A renewed website certificate does not necessarily replace a separately copied panel certificate.

Troubleshooting

Validation fails: check A/AAAA records, DNS propagation, challenge reachability and CDN/redirect rules. Read the actual validation result.
Browser reports a different name: use the certificate hostname or install the right certificate; do not accept an unrelated certificate as the permanent solution.
Domain works on 443 but panel does not: verify the panel's actual port. Website HTTPS and panel HTTPS are separate listeners.
Panel restarts during deployment: reconnect to the correct hostname and existing entrance. Preserve your SSH/provider-console route.
Renewal task fails later: check its log, DNS and validation path before expiry. Do not wait until the certificate is already invalid.

Related: Set up aaPanel domain access.
Reference: aaPanel domain and panel-SSL documentation. © AdminsForum.]]> Quick answer
Use Settings → Panel SSL → Modify → Lets Encrypt to request a certificate for your panel hostname, then sign in through that same hostname. A website's SSL certificate does not automatically secure the separate aaPanel listener.

Lab result
On aaPanel 8.0.6, the native panel-certificate workflow deployed a trusted certificate for cp.adminslab.com. The panel keeps its existing port 18443. The certificate expires on 11 January 2027, and a client using its normal trusted CA store verified the hostname and negotiated TLS 1.3. The domain login succeeded.

.jpg

Code:

https://cp.example.com:YOUR_PANEL_PORT/YOUR_SECURITY_ENTRANCE

Validation fails: check A/AAAA records, DNS propagation, challenge reachability and CDN/redirect rules. Read the actual validation result.
Browser reports a different name: use the certificate hostname or install the right certificate; do not accept an unrelated certificate as the permanent solution.
Domain works on 443 but panel does not: verify the panel's actual port. Website HTTPS and panel HTTPS are separate listeners.
Panel restarts during deployment: reconnect to the correct hostname and existing entrance. Preserve your SSH/provider-console route.
Renewal task fails later: check its log, DNS and validation path before expiry. Do not wait until the certificate is already invalid.

Related: Set up aaPanel domain access.
Reference: aaPanel domain and panel-SSL documentation. © AdminsForum.]]> <![CDATA[Access aaPanel Through a Domain Name with Cloudflare DNS]]> https://adminsforum.com/Thread-guide-access-aapanel-through-a-domain-name-with-cloudflare-dns Tue, 13 Oct 2026 10:58:35 +0800 DEV]]> https://adminsforum.com/Thread-guide-access-aapanel-through-a-domain-name-with-cloudflare-dns Quick answer
Create a DNS-only A record for a dedicated panel hostname, keep the existing aaPanel port and security entrance, and install a trusted certificate covering that hostname. In our lab, cp.adminslab.com points to 217.217.235.82 and the panel still uses port 18443. We left the Domain binding field empty.

Before you start
Have a working panel login and an independent SSH/provider-console recovery route. Record the current port and security entrance privately. These are your existing values, not a reason to reset them. Back up panel configuration before replacing a certificate. Use a subdomain dedicated to administration, such as cp.example.com, rather than reusing a public website hostname.

1. Add the DNS record
In Cloudflare, select the correct domain → DNS → Records → Add record. Choose A, enter cp as the name and your VPS IPv4 address as the content. Turn Proxy status off so it says DNS only, leave TTL at Auto and save.

.jpg

panel-dns-branded-20261013.jpg (Size: 144.43 KB / Downloads: 6)
Our saved record resolves cp.adminslab.com to the lab VPS. Replace that domain and address with your own values. Do not change your main website or mail records while adding the panel record.
The lab's port 18443 is outside Cloudflare's ordinary supported proxy ports. Orange-cloud proxying would not make this direct panel URL work. DNS only sends the browser directly to the origin; retain your server firewall and panel authentication.

2. Understand the complete URL
The login address contains three parts:

Code:

https://cp.example.com:YOUR_PANEL_PORT/YOUR_SECURITY_ENTRANCE

The domain replaces the IP address. The port and security entrance remain the ones already configured in aaPanel. Our port is 18443, but your installation may use another number. Keep the real entrance private; this guide deliberately does not publish it.
A DNS record does not move the panel onto port 443 or change its login path. Typing only the hostname may reach a website or a default web-server page instead of aaPanel.

3. Install HTTPS before signing in through the hostname
A certificate issued for the server IP will not automatically cover the new domain. In Settings → Panel SSL → Modify, use the certificate workflow for the panel hostname. Our native Let's Encrypt workflow applied and deployed a certificate for cp.adminslab.com.

.jpg

panel-cert-branded-20261013.jpg (Size: 53.76 KB / Downloads: 6)
We verified its chain and hostname with normal certificate checks, negotiated TLS 1.3 and then signed in through the domain. Its displayed expiry is 11 January 2027. This is evidence from the lab, not a promise that your application will complete without DNS or validation fixes.

4. Keep Domain binding separate
Settings → Domain is a restriction, not the DNS record editor. The panel warns that setting it limits access to that domain. We kept it empty while testing, so changing the hostname did not also add an access restriction.
There is still a certificate consequence: after installing a domain-only certificate, visiting the raw IP through HTTPS produces a name mismatch. Empty binding does not make that certificate valid for the IP. Use the proper domain URL and retain SSH/provider-console access for recovery; do not bypass certificate warnings.

5. Verify the new route
Check the DNS answer is your VPS, confirm the URL contains the actual port and entrance, inspect the certificate domain and expiry, and sign in using the existing account. Open a normal panel page after login to confirm the session works. Our domain login and settings page passed these checks.
Do not change the panel port, enable a reverse proxy or restrict authorized IPs during the same first test. Each adds a separate failure point and deserves its own verified step.

Troubleshooting

DNS points elsewhere: correct the A record and wait for the relevant DNS cache to refresh. Check for an unintended AAAA record if IPv6 takes a different route.
Timeout: check the exact panel port, server firewall, provider firewall and DNS-only status.
404 at the hostname: confirm the security entrance and port. aaPanel may intentionally return 404 for the wrong entrance.
Certificate mismatch: use the hostname covered by the certificate or deploy the correct certificate. A website certificate on 443 does not automatically configure the panel listener.
IP URL stopped validating: expected if the replacement certificate covers only the domain. Recover through the correct hostname or your independent administration route.

References: aaPanel domain-access documentation and Cloudflare supported ports. © AdminsForum.]]> Quick answer
Create a DNS-only A record for a dedicated panel hostname, keep the existing aaPanel port and security entrance, and install a trusted certificate covering that hostname. In our lab, cp.adminslab.com points to 217.217.235.82 and the panel still uses port 18443. We left the Domain binding field empty.

Before you start
Have a working panel login and an independent SSH/provider-console recovery route. Record the current port and security entrance privately. These are your existing values, not a reason to reset them. Back up panel configuration before replacing a certificate. Use a subdomain dedicated to administration, such as cp.example.com, rather than reusing a public website hostname.

1. Add the DNS record
In Cloudflare, select the correct domain → DNS → Records → Add record. Choose A, enter cp as the name and your VPS IPv4 address as the content. Turn Proxy status off so it says DNS only, leave TTL at Auto and save.

.jpg

Code:

https://cp.example.com:YOUR_PANEL_PORT/YOUR_SECURITY_ENTRANCE

DNS points elsewhere: correct the A record and wait for the relevant DNS cache to refresh. Check for an unintended AAAA record if IPv6 takes a different route.
Timeout: check the exact panel port, server firewall, provider firewall and DNS-only status.
404 at the hostname: confirm the security entrance and port. aaPanel may intentionally return 404 for the wrong entrance.
Certificate mismatch: use the hostname covered by the certificate or deploy the correct certificate. A website certificate on 443 does not automatically configure the panel listener.
IP URL stopped validating: expected if the replacement certificate covers only the domain. Recover through the correct hostname or your independent administration route.

References: aaPanel domain-access documentation and Cloudflare supported ports. © AdminsForum.]]> <![CDATA[Redirect HTTP to HTTPS in aaPanel Free Edition (Nginx)]]> https://adminsforum.com/Thread-guide-redirect-http-to-https-in-aapanel-free-edition-nginx Sun, 11 Oct 2026 02:40:54 +0800 DEV]]> https://adminsforum.com/Thread-guide-redirect-http-to-https-in-aapanel-free-edition-nginx Quick answer
After installing a valid website certificate, redirect HTTP requests to HTTPS. This aaPanel Free Edition guide uses a custom Nginx rewrite rule that preserves the hostname, path and query string, while keeping the ACME challenge path available for certificate validation.

Before you start
Confirm both HTTPS hostnames work without certificate warnings. This example is for Nginx, not Apache or OpenLiteSpeed. Back up existing rewrite rules before editing them; retain any application rules below the new redirect block.
Install website SSL first.

1. Open the rewrite editor
Go to Website, open your site's settings, and choose URL rewrite. Our new lab site had an empty rule file. Do not replace an existing application's rewrite configuration blindly.

2. Add the redirect block
Place this block above your application rewrite rules:

Code:

# AdminsForum tutorial: HTTPS redirect with ACME exception
set $af_https_redirect 0;
if ($scheme = http) {
    set $af_https_redirect 1;
}
if ($uri ~ "^/\.well-known/acme-challenge/") {
    set $af_https_redirect 0;
}
if ($af_https_redirect = 1) {
    return 301 https://$host$request_uri;
}

The first condition marks HTTP requests for redirection. The next clears that flag for the ACME challenge path. The final return performs the redirect. HTTPS requests are not redirected by this block.

[Image: attachment.php?aid=18]

3. Save and test
Click Save. If aaPanel reports a configuration error, restore your previous rules rather than leaving an invalid configuration. Our Nginx configuration test passed after saving.
Check HTTP and HTTPS separately. Our results were:

Code:

http://adminslab.com/ -> 301 -> https://adminslab.com/
http://www.adminslab.com/test-path?check=1
 -> 301 -> https://www.adminslab.com/test-path?check=1
https://adminslab.com/ -> 200

We also placed a temporary text file under /.well-known/acme-challenge/ and confirmed it returned HTTP 200 directly, then removed the test file. A nonexistent challenge URL can behave differently because the server's error-page rules also run.

Important limits

This is a permanent 301 redirect; browsers may cache it. Use a fresh request when testing a rollback.
This preserves www and non-www rather than choosing a canonical hostname.
We tested the certificate-validation route, not a future certificate renewal.
Cloudflare records remain DNS only. Do not combine this setup with an incompatible proxy SSL mode that creates a loop.
If you later select a rewrite template, check that it has not replaced this custom block.

Troubleshooting
A redirect loop usually means HTTPS is being redirected again or another proxy/application rule conflicts. Restore your saved rules and inspect the complete chain. A certificate warning must be fixed at the certificate level, not hidden with a redirect.

Tested: 10 October 2026, aaPanel Free Edition 8.0.6 with Nginx. Original AdminsForum lab screenshot.

.jpg

https-redirect-rule-20261010.jpg (Size: 51.69 KB / Downloads: 7) ]]> Quick answer
After installing a valid website certificate, redirect HTTP requests to HTTPS. This aaPanel Free Edition guide uses a custom Nginx rewrite rule that preserves the hostname, path and query string, while keeping the ACME challenge path available for certificate validation.

Before you start
Confirm both HTTPS hostnames work without certificate warnings. This example is for Nginx, not Apache or OpenLiteSpeed. Back up existing rewrite rules before editing them; retain any application rules below the new redirect block.
Install website SSL first.

1. Open the rewrite editor
Go to Website, open your site's settings, and choose URL rewrite. Our new lab site had an empty rule file. Do not replace an existing application's rewrite configuration blindly.

2. Add the redirect block
Place this block above your application rewrite rules:

Code:

# AdminsForum tutorial: HTTPS redirect with ACME exception
set $af_https_redirect 0;
if ($scheme = http) {
    set $af_https_redirect 1;
}
if ($uri ~ "^/\.well-known/acme-challenge/") {
    set $af_https_redirect 0;
}
if ($af_https_redirect = 1) {
    return 301 https://$host$request_uri;
}

Code:

http://adminslab.com/ -> 301 -> https://adminslab.com/
http://www.adminslab.com/test-path?check=1
 -> 301 -> https://www.adminslab.com/test-path?check=1
https://adminslab.com/ -> 200

This is a permanent 301 redirect; browsers may cache it. Use a fresh request when testing a rollback.
This preserves www and non-www rather than choosing a canonical hostname.
We tested the certificate-validation route, not a future certificate renewal.
Cloudflare records remain DNS only. Do not combine this setup with an incompatible proxy SSL mode that creates a loop.
If you later select a rewrite template, check that it has not replaced this custom block.

https-redirect-rule-20261010.jpg (Size: 51.69 KB / Downloads: 7) ]]> <![CDATA[Install Let's Encrypt SSL in aaPanel Free Edition]]> https://adminsforum.com/Thread-guide-install-let-s-encrypt-ssl-in-aapanel-free-edition Sun, 11 Oct 2026 02:35:26 +0800 DEV]]> https://adminsforum.com/Thread-guide-install-let-s-encrypt-ssl-in-aapanel-free-edition Quick answer
Open Website in aaPanel Free Edition, select the site's SSL status, choose Let's Encrypt, select File Verification and the required domains, then Apply. Confirm that the certificate is deployed and that both HTTPS addresses work with normal certificate validation.

Before you start

Create the website and include every hostname you want on the certificate.
Point its DNS records to the VPS and confirm public DNS resolution.
Check that the HTTP website works and port 80 is reachable for file validation.
Allow port 443 for HTTPS.

We used adminslab.com and www.adminslab.com with Cloudflare DNS-only records during this test. This certificate is for the website, not the aaPanel login address.
Create the website first.

1. Open the website SSL settings
Go to Website and click Not Set in the site's SSL column, or open the site's settings and select SSL. Choose the Let's Encrypt tab.

2. Choose File Verification and domains
Keep File Verification selected. Tick each hostname that should be included. In our lab, we selected both adminslab.com and www.adminslab.com.

[Image: attachment.php?aid=16]

HTTP-01 file validation uses port 80 and requires the challenge file to be reachable. Wildcard certificates require a different validation method, such as DNS validation; they are not covered by this walkthrough.

3. Apply and wait
Click Apply once. Let aaPanel complete its initialization and certificate request. Do not repeatedly request new certificates while one is running. Read any error before retrying.
When successful, the certificate settings show Current Certs - Deployed, the covered domains and an expiry date.

[Image: attachment.php?aid=17]

Our certificate covers both lab hostnames and expires on 8 January 2027. That date belongs to this test certificate; check the date shown for your own certificate.

4. Verify HTTPS
Open both addresses:

Code:

https://adminslab.com
https://www.adminslab.com

They should load without a certificate warning. Our tests returned HTTP 200 for both URLs, with certificate validation successful. Do not bypass warnings or disable certificate checks to call a deployment successful.
The default page test verifies HTTPS delivery, not an installed application or its mixed-content settings.

5. Plan renewal and redirects
aaPanel displays an automatic renewal reminder. We have verified issuance and deployment, not a future renewal. Keep the validation route available and check expiry and renewal logs before the certificate expires.
Issuing a certificate and redirecting HTTP to HTTPS are separate steps. This guide installs HTTPS; an HTTP-to-HTTPS redirect will be covered separately after checking the website. Cloudflare proxying and its SSL mode will also be separate.

Troubleshooting
Validation fails: Check public DNS, the selected hostnames, port 80 and the challenge path. Redirects, proxy rules or access restrictions can interfere.
Only one hostname works: Check that both are in the site's domain list and certificate.
Wrong certificate: Check the hostname, site selection and which server DNS points to.
HTTPS times out: Check port 443, Nginx and the provider firewall.
Rate-limit error: Read the error and avoid repeated requests while fixing DNS or routing.

Official reference
Let's Encrypt validation methods

Related
Add a domain to Cloudflare Free

Tested: 10 October 2026, aaPanel Free Edition 8.0.6, Nginx on Ubuntu 22.04. Original AdminsForum lab screenshots. Private keys are excluded from the screenshots.

.jpg

website-ssl-apply-20261010.jpg (Size: 60.18 KB / Downloads: 10)

.jpg

website-ssl-deployed-20261010.jpg (Size: 26.35 KB / Downloads: 11) ]]> Quick answer
Open Website in aaPanel Free Edition, select the site's SSL status, choose Let's Encrypt, select File Verification and the required domains, then Apply. Confirm that the certificate is deployed and that both HTTPS addresses work with normal certificate validation.

Before you start

Create the website and include every hostname you want on the certificate.
Point its DNS records to the VPS and confirm public DNS resolution.
Check that the HTTP website works and port 80 is reachable for file validation.
Allow port 443 for HTTPS.

Code:

https://adminslab.com
https://www.adminslab.com

website-ssl-apply-20261010.jpg (Size: 60.18 KB / Downloads: 10)

.jpg

website-ssl-deployed-20261010.jpg (Size: 26.35 KB / Downloads: 11) ]]>