Live demo Subscribe →

Data and certificates

HTTPS certificates

Certificates are issued in-process as soon as a domain resolves to the server and renewed before they expire. Wildcards use Cloudflare DNS-01. Nothing to install and nothing to schedule.

Verified against auraPanel 1.21.3· Last updated 17 September 2026

How certificates are issued

Certificates come from Let's Encrypt through an ACME client built into the panel. There is no certbot and nothing to schedule. When a site is created it gets a self-signed placeholder at once so HTTPS works immediately, and the real certificate is requested in the background; the site's overview usually shows it issued within 10 to 60 seconds of DNS pointing at the server.

The default challenge is HTTP-01: Let's Encrypt fetches a token from http://<domain>/.well-known/acme-challenge/, which every server block serves from /var/lib/aurapanel/acme/, including when the site redirects everything else to HTTPS.

DNS prerequisites

  • An A record for the domain pointing at the server's public IPv4 address, and an AAAA record if the server has IPv6. The panel's dashboard shows the public address it detected.
  • Port 80 reachable from the internet. The installer's firewall rules allow it; check your provider's firewall too.
  • If the DNS record is proxied through Cloudflare (orange cloud), use DNS-01 below.

Wildcards and Cloudflare: DNS-01

Wildcard certificates, and domains whose origin is hidden behind Cloudflare or a firewall, use the DNS-01 challenge through the Cloudflare API.

  1. In Cloudflare, open My Profile → API Tokens and create a token with Zone · DNS · Edit on the zone. (Add Zone · SSL and Certificates · Edit only if you also use the panel's origin mTLS.)
  2. In the site's Security tab, paste the token under Cloudflare and turn on DNS-01 certificate challenge. The token is stored encrypted.
  3. Renew or wait for the next issuance. The panel creates the validation TXT record, completes the challenge and removes the record.

Cloudflare's proxy also caches. The panel marks its own API and interface responses CDN-Cache-Control: no-store, but your application's caching behaviour behind Cloudflare is your own configuration.

Renewal

A renewal loop starts 30 seconds after the panel boots and runs every 12 hours. Any certificate within 30 days of expiry is re-issued, with up to an hour of random delay per certificate so a server with many sites does not hit rate limits. A failed renewal records its error on the site and is retried at the next pass. To renew by hand, press Renew SSL on the site or run:

apcli ssl renew example.com

Where the certificate lives: /etc/aurapanel/ssl/<domain>.crt and .key. Uploading your own certificate is not supported; the panel only manages certificates it issues.

Force HTTPS

Force HTTPS redirect in the site's Security tab is on for new sites. It redirects every HTTP request to HTTPS except the ACME challenge path, and it does nothing until a certificate has been issued, so a site is never redirected onto a placeholder. For an apex domain the server block also answers for the www. name.

The panel's own certificate

Set a panel domain (at install with --panel-domain=, or under Settings) and the panel issues a Let's Encrypt certificate for itself the same way. Until then it serves a self-signed certificate on https://<server-ip>:8443. See Install auraPanel.

Rate limits and staging

Let's Encrypt allows five identical certificates per registered domain per week. The panel avoids burning that budget: a valid certificate already on disk is reused rather than re-requested, and the installer can use Let's Encrypt's staging environment when it needs to test issuance repeatedly.

When issuance fails

The site's overview shows the last error verbatim. The panel also runs a reachability pre-flight and phrases the common causes:

"domain DNS may not point at this server, port 80 may be blocked…"

Check the A/AAAA record with dig +short example.com against the server's public IP, and that port 80 is open in your provider's firewall.

"HTTP-01 endpoint responded 200 but with the wrong body — something between you and the server is intercepting…"

A proxy or CDN in front of the server (usually Cloudflare) is answering the challenge itself. Switch the site to DNS-01.

"(this looks like a proxied / firewalled origin; enable Cloudflare DNS-01 in this site's SSL tab to issue via DNS instead)"

Same cause, reported by the ACME client after a failed HTTP-01. Use DNS-01.

"DNS-01 was selected but no Cloudflare API token is configured. Add one in this site's Security tab, or turn off Cloudflare DNS-01 to use HTTP-01."

The toggle is on without a token. Paste one, or turn the toggle off.

Cloudflare shows error 525 for a hostname

525 means Cloudflare reached the server but the TLS handshake failed. The server only completes handshakes for hostnames it has a server block for; a redirect hostname or a subdomain with no site returns exactly this. Create the site or redirect for that hostname. See Troubleshooting.

  • Create and manage sitesCreate a site in auraPanel: site types, the system user and directory layout, DNS, HTTPS, redirects, cron, SFTP and deletion — common to every site type.
  • Security and hardeningauraPanel's security controls: per-site isolation, the Cloudflare edge shield, encrypted secrets, audit log, signed updates, and what stays with the operator.
  • TroubleshootingDiagnose common auraPanel problems: panel not loading, a site showing 502 or Cloudflare 525, certificate issuance failing, a service not starting, apcli doctor.

Try the live demo

A real auraPanel on a real server, shared with everyone. Sign in with the demo account and click around.

Email
demo@goaura.one
Password
demo1234
Open the demo panel ↗

Shared public demo, so please don’t put anything personal in it. More about the demo →

Talk to us

Tell us what you need and how to reach you. A person reads this, not a queue.

We use these details only to reply to you. Privacy

Recent updates

What shipped in the last releases. With automatic updates on, each lands on your server the moment it is published.

  1. v1.21.3
    Framework sites were undetectable, and a restore could silently point the copy at the original's live database.

    DetectApp looked for each application's signature relative to the docroot — but every PHP framework in the registry serves from a subdirectory (DocrootSub: public, webroot, web, pub, docroot) and keeps the file that identifies it one level *above* that. So the Laravel signature searched <project>/public/artisan,…

  2. v1.21.2
    Restarting nginx now blocks the panel and reconnects, instead of showing a notice.

    v1.21.1 stopped the false "HTTP 520" but only put up a toast — and a toast is the wrong affordance when the panel itself is about to go away: the page sat there looking broken while every request failed underneath it.

  3. v1.21.1
    Restarting nginx from Services no longer reports a false failure.

    It showed "Restart failed — HTTP 520". The panel is reverse-proxied *by* nginx, so the request deadlocked against itself: the handler blocked waiting for the restart to finish, while nginx's graceful stop waited for that very request to drain. Neither could proceed until nginx's stop-retry timeout force-killed it,…

  4. v1.21.0
    Per-site X-Frame-Options, fixing page builders that couldn't load their preview.

    Elementor's editor failed with *"Multiple 'X-Frame-Options' headers with conflicting values ('DENY, SAMEORIGIN')"*. The cause is that nginx's add_header appends rather than replaces: when the application also sets the header — a WordPress security plugin, or a CDN transform — the browser received two values,…

  5. v1.20.6
    The multi-database restore refusal now says what is in the backup and what still works.

    It read only "Restoring a multi-database site isn't supported yet", which is a dead end: it named neither the databases involved, nor why one of them is the limit, nor any route forward.

  6. v1.20.5
    Services: cards in a row now match heights.

    Like the settings grid before it, the Services grid pinned each card to its own content height, so a row often showed one card noticeably shorter than the card beside it. Each row now takes the taller card's height and both fill it, and it re-balances as content changes — a runtime installed, a longer service list.

  7. v1.20.4
    Settings: paired cards now match heights.

    Organisation / Panel Domain and auraPanel Updates / Session timeout each sat at their own content height, so a row showed one card visibly shorter than its neighbour. Each row now takes the taller card's height and both fill it — driven by content, not a fixed value, so it still adapts as a card grows (a validation…

  8. v1.20.3
    Settings: Organisation and Panel Domain now share a row too.

    They were full-width blocks stacked above the rest of the page; they now sit side by side in the same two-column grid as the Updates / Session timeout pair, so the top of Settings reads as two tidy rows instead of four stacked bands. Both cards shrink cleanly — the logo drop zone is a fixed 44×44 and the name field…

All releases on GitHub ↗