Get a free SSL certificate for your panel links (Let's Encrypt)

Your website can sit behind a proxy (the orange cloud). In that case the proxy can present a certificate for the website. Your customer login hostname is different. It must be a DNS only (grey cloud) CNAME to connect.unitward.com, so traffic goes straight to the panel. A proxy certificate therefore does not cover my.yourbrand.com.

You install a certificate of your own on the panel side. Browsers will then show a padlock when customers open https://my.yourbrand.com.

Let's Encrypt is a free, trusted, non-profit certificate authority. You do not create a website account with them. A small tool on your computer talks to their ACME service and proves you control the domain.

Issue one wildcard certificate that covers yourbrand.com and *.yourbrand.com. That single certificate then works for my.yourbrand.com and www.yourbrand.com. A wildcard does not include the root name on its own, so you always add both names. It also does not cover a name with an extra label, such as shop.eu.yourbrand.com.

Validation uses DNS-01: a short TXT record at _acme-challenge.yourbrand.com. Option A below can create and remove that record for you. Option B asks you to add it yourself.

Option A is the easiest path if this domain is already on Cloudflare. You create a token that can edit DNS for that zone only. Do not use a global API key.

In Cloudflare, open your profile, then API Tokens, and click Create Token. Use a custom token with these permissions:

• Zone — DNS — Edit
• Zone — Zone — Read

Under Zone Resources, include only the one zone yourbrand.com. Create the token and copy it once; Cloudflare will not show it again. Store it in a credentials file. On Linux, if you will run certbot with sudo, use an absolute path under root, because ~ would expand to /root:

sudo mkdir -p /root/.secrets
sudo nano /root/.secrets/cloudflare.ini

Put only this line in the file, with your real token in place of the placeholder:

dns_cloudflare_api_token = your-cloudflare-api-token

sudo chmod 600 /root/.secrets/cloudflare.ini

On macOS, you can use /etc/letsencrypt/secrets/cloudflare.ini with the same contents and chmod 600, or another path that the certbot process can read. Never put the token in a chat, an email or a screenshot.

On Linux, Certbot’s documented install is snap:

sudo snap install --classic certbot
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-cloudflare

Issue the certificate (use the same credentials path you created):

sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
  -d yourbrand.com \
  -d '*.yourbrand.com'

Certbot writes these files under /etc/letsencrypt/live/yourbrand.com/:

fullchain.pem is the certificate and chain together. Use it only if a form asks for a full chain; the panel form uses the three fields above.

On macOS with Homebrew:

brew install certbot
$(brew --prefix certbot)/libexec/bin/pip install certbot-dns-cloudflare

Then run sudo certbot certonly with the same flags, pointing --dns-cloudflare-credentials at your credentials file.

Using acme.sh instead (Linux or macOS). Let’s Encrypt is not the default CA, so you must pass --server letsencrypt:

curl https://get.acme.sh | sh -s email=support@yourbrand.com
# open a new terminal (or source the installer message) so the acme.sh command is available
export CF_Token="your-cloudflare-api-token"
export CF_Zone_ID="your-cloudflare-zone-id"
acme.sh --issue --dns dns_cf -d yourbrand.com -d '*.yourbrand.com' --server letsencrypt

You can copy the Zone ID from the Cloudflare overview page for that domain. Files are saved under ~/.acme.sh/yourbrand.com/ or ~/.acme.sh/yourbrand.com_ecc/:

Use this if you cannot create a Cloudflare token, or if the domain’s DNS is not on Cloudflare. Certbot will pause and show a TXT value to add.

sudo certbot certonly --manual --preferred-challenges dns \
  -d yourbrand.com -d '*.yourbrand.com'

Create a TXT record for _acme-challenge.yourbrand.com with the value Certbot prints. Wait until the record is visible, then continue in the terminal. You may be asked for two TXT values (one for each name); add both, or replace the value if the tool asks you to do it in two rounds. The resulting files are in the same /etc/letsencrypt/live/yourbrand.com/ folder as Option A.

A certificate issued this way does not auto-renew, because Certbot cannot update the TXT record by itself. Plan to repeat this step before 90 days, or switch to Option A when you can.

Open your reseller panel. Go to Settings > Branding Settings > Control Panel URL. Under Step 3: Secure your URL, open the upload option (it may be labelled Upload certificates).

Paste or upload:

• Private Key — privkey.pem or yourbrand.com.key
• Certificate (sometimes labelled SSL Certificate) — cert.pem or yourbrand.com.cer
• CA Bundle — chain.pem or ca.cer

Save or submit. A separate certificate-upload login may appear. Use the same username and password as your reseller panel. Do not use a different account.

Wait a few minutes, then open https://my.yourbrand.com in a private browser window. Check that:

• The address uses https:// and the padlock is visible.
• There is no security warning, and the page is not forced back to http://.
• The certificate is issued for *.yourbrand.com or for my.yourbrand.com (open the padlock and view the certificate).
• The sign-in page is the customer panel on your domain, not a different hostname.

If the browser still warns, confirm the CNAME is DNS only, the three fields were the matching set from the same issue, and DNS for the hostname has propagated.

Let's Encrypt certificates last 90 days. Set a reminder about three weeks before expiry.

If you used Certbot with the Cloudflare plugin, test renewal and keep the timer Certbot installed:

sudo certbot renew --dry-run

If you used acme.sh, the installer normally adds a cron job. You can also run:

acme.sh --renew -d yourbrand.com --server letsencrypt

After a successful renewal, re-upload the new Private Key, Certificate and CA Bundle on the same Control Panel URL page. The panel does not pick up the new files by itself.

Manual DNS issuance (Option B) will not renew automatically. Repeat Option B, or move to Option A.