How to install Let's Encrypt SSL certificate for a domain in Plesk?

Vincent Lauton

Updated September 18, 2026 23:39

Plesk for Windows Plesk for Linux ext: le ext: sslit

Applicable to:

Plesk for Linux
Plesk for Windows

Question

How to install a Let's Encrypt SSL certificate for a domain in Plesk?

Answer

There are two methods available for generating a Let's Encrypt certificate in Plesk:

HTTP challenge (http-01) where a file containing a unique token is placed on example.com/.well-known/acme-challenge/ and checked by a remote server
DNS challenge (dns-01) where a TXT record containing a unique token is placed under the domain at _acme-challenge.example.com

The HTTP challenge requires the domain to point to the server, and requires the server to be accessible from the Internet so the token file can be verified by Let's Encrypt's servers. All steps occur automatically.

The DNS challenge only requires that the provided TXT record be placed in either the top level domain's DNS (for wildcards) or the DNS of each individual domain, subdomain and alias. May require manual intervention if the domain being secured uses external nameservers. This challenge is mandatory for generating wildcard certificates (certificates that cover all possible subdomains).

In general, DNS challenge should always be used for wildcards and servers that are blocked off from the Internet, while HTTP challenge is usually more suited for all other use cases.

HTTP challenge (http-01)

Log into Plesk
Install extensions SSL It! and Let's Encrypt
Go to Domains > example.com > Hosting & DNS > Hosting
Enable the option SSL/TLS support if it is disabled and click OK or Apply at the bottom of the page:
Go to Domains > example.com and click SSL/TLS Certificates:
At the bottom of the page, click Install in the section More options > Install a free basic certificate provided by Let's Encrypt:
Select the desired options for the certificate to be issued and HTTP as the Domain validation method, and any desired aliases. We recommend enabling the following options:
- Secure the domain name
- Include a "www" subdomain for the domain and each selected alias
- Secure webmail on this domain
- Secure mail on this domain
- Assign the certificate to mail domain
Click Get it free

DNS challenge (dns-01)

Log into Plesk
Go to Domains > example.com > SSL/TLS Certificates and press Install:
Select the desired options and DNS as Domain validation method, and any desired aliases. We recommend enabling the following options:
- Secure the domain name
- To create a wildcard: Secure the wildcard domain (including www and webmail)
- Include a "www" subdomain for the domain and each selected alias
- Secure webmail on this domain
- Secure mail on this domain
- Assign the certificate to mail domain
After clicking the Install button, Let's Encrypt will provide a DNS TXT record:
- If Plesk server is the authoritative DNS for the domain, the record will be added automatically
- If DNS is managed by an external server it should be added manually

After completing DNS configuration and verifying that the DNS TXT _acme-challenge.<domain> record resolves properly (dnschecker.org can be used for this), click the Continue button to issue the certificate.

Note: This iteration of Let's Encrypt wildcard certificate has several limitations:

A wildcard certificate is only assigned to the main domain.
To apply it to subdomains, go to Domains > sub.example.com > Hosting & DNS > Hosting of each subdomain and chose the new wildcard Let's Encrypt certificate in the Certificate drop-down menu.
New subdomains do not get the wildcard certificate automatically. It has to be selected for them manually as well.
Wildcard certificates will not be renewed automatically if the DNS zone is managed by an external DNS server.

Limitations:

Technical domains (example-domain.plesk.page) can only be secured using HTTP challenge