Articles in this section

See more

How to secure Plesk and mail server with Let's Encrypt certificate via CLI?

Avatar
Julia Minenkova
Updated
Follow
Plesk for Windows Plesk for Linux kb: how-to ext: le ABT: Group A

Applicable to:

  • Plesk for Linux
  • Plesk for Windows

Question

How to secure Plesk and mail server with Let's Encrypt certificate using command line?

Answer

By default, new Plesk installations come with pre-installed Let's Encrypt extension and if the server's hostname is correct, Plesk secures itself automatically.

Note: To issue a certificate, correct hostname should be used in OS, and it should resolve to the server's IP address.
Here and forth example.com will be used as the server's hostname and 203.0.113.2 will be used as the server's public IP.

Check if server's hostname resolves properly

  • On Windows

    1. Connect to the server via RDP

    2. Find out server's hostname:

      C:\> plesk bin server_pref --get-hostname
      example.com

    3. Make sure that the hostname points to the server's IP:

      C:\> nslookup example.com 8.8.8.8
      Server: google-public-dns-a.google.com
      Address: 8.8.8.8

      Non-authoritative answer:
      Name: example.com
      Addresses: 203.0.113.2

  • On Linux

    1. Connect to the server via SSH

    2. Find out server's hostname:

      # plesk bin server_pref --get-hostname
      example.com

    3. Make sure that the hostname points to the server's IP:

      # host example.com 8.8.8.8
      Using domain server:
      Name: 8.8.8.8
      Address: 8.8.8.8#53
      Aliases:

      example.com has address 203.0.113.2

Issue and apply the certificate to the server with CLI utility

  1. Connect to the server via SSH or RDP

  2. Make sure that the latest Let's Encrypt extension is installed on the server:

    # plesk bin extension -i letsencrypt

    C:\> plesk bin extension -i letsencrypt

  3. Issue and secure Plesk with a certificate:

    • On Linux:

      # plesk bin extension --exec letsencrypt cli.php --secure-plesk -m john.doe@example.com -w /var/www/vhosts/default/htdocs -d example.com

    • On Windows:

      C:\> plesk bin extension --exec letsencrypt cli.php --secure-plesk -m john.doe@example.com -w "%plesk_dir%\default\htdocs" -d example.com

  4. Secure additional services:

    • Set the certificate as default for an IP address:

      # plesk bin certificate --assign-cert "Lets Encrypt certificate" -ip 203.0.113.2

    • Set the certificate for the mail server:

      # plesk bin mailserver --set-certificate "Lets Encrypt certificate"

    • Set the certificate for Plesk Control panel:

      # plesk bin server_pref --update -panel-certificate "Lets Encrypt certificate"

Comments

4 comments

Sort by Date Votes
  • Avatar
    Ryan Johnson (Edited ) 
    plesk bin server_pref --get-hostname

    does not give the correct hostname. It gives some local-only host name for the server, like

    plesk-ubuntu-s-1vcpu-1gb-nyc1-01.local

    where the first part (before ".local") is the name of the resource in DigitalOcean's interface.

    0
    Comment actions Permalink
  • Avatar
    Mikhail Shport

    Hi Ryan,

    The mentioned command shows the information that is set in Plesk > Tools & Settings > Server Settings > Full hostname field.

    Sometimes, the hostname of the server itself does not change after it is set via the Plesk UI. In that case, it should be changed manually.

    You may take a look at this article for help: How to change or get the server hostname on Plesk server

    0
    Comment actions Permalink
  • Avatar
    Marco Marsala

    Getting this error:

    Curl failed: Peer certificate cannot be authenticated with given CA certificates
    Failed to parse response. Reason: Failed to read data from stream Process output:

    ERROR: No supported protocols supplied.

    Please update KB with this case.

    0
    Comment actions Permalink
  • Avatar
    Mar Spe

    command "plesk bin extension --exec letsencrypt cli.php -secure-plesk -m email@domain.tld -w /var/www/vhosts/default/htdocs -d hostname.domain.tld" responds with error message 
    'ERR [extension/letsencrypt] The execution of cli.php has failed with the following message: Option "c" requires a parameter.'

    Product version: Plesk Obsidian 18.0.48.0
    OS version: Ubuntu 18.04 x86_64

    Does this KB article require an update or am I doing somethin wrong?

    0
    Comment actions Permalink

Please sign in to leave a comment.

Have more questions? Submit a request

Related articles