VestaCP is an open-source control panel that, out of the box, secures its admin interface with a self-signed certificate \u2014 which works for encryption, but triggers a browser security warning since it isn’t signed by a trusted certificate authority. Replacing it with a proper SSL certificate removes that warning and gives you the padlock\/secure icon browsers show for trusted connections.<\/p>\n\n\n\n
\n\n\n\n
Implementation<\/h2>\n\n\n\nI. Prerequisites<\/h3>\n\n\n\n
Before you install an SSL certificate for VestaCP, make sure you have:<\/p>\n\n\n\n
- \n
- Access to the VestaCP panel<\/li>\n\n\n\n
- SSH access to the server<\/li>\n\n\n\n
- Your SSL certificate and its matching private key (this guide assumes you already have both \u2014 this guide doesn’t cover certificate issuance itself, whether from a paid CA or Let’s Encrypt)<\/li>\n<\/ul>\n\n\n\n
II. How VestaCP Uses These Files<\/h3>\n\n\n\n
VestaCP reads its SSL configuration from three specific files on every restart:<\/p>\n\n\n\n
- \n
certificate.crt<\/code><\/strong> \u2014 the SSL certificate itself<\/li>\n\n\n\ncertificate.key<\/code><\/strong> \u2014 the private key matching that certificate<\/li>\n\n\n\ncertificate.ca<\/code><\/strong> \u2014 the intermediate\/CA bundle, needed to complete the trust chain (this file is optional depending on your certificate authority, but commonly required \u2014 more on this in Step V)<\/li>\n<\/ul>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/09\/vestacp_ssl_architecture-1024x512.png\")
<\/a><\/figure>\n\n\n\nIII. Back Up the Existing Self-Signed Certificate<\/h3>\n\n\n\n
Move the current self-signed certificate and key aside rather than deleting them outright, so you have a fallback if anything goes wrong:<\/p>\n\n\n\n
mv \/usr\/local\/vesta\/ssl\/certificate.crt \/usr\/local\/vesta\/ssl\/certificate.crt_old\nmv \/usr\/local\/vesta\/ssl\/certificate.key \/usr\/local\/vesta\/ssl\/certificate.key_old\n<\/pre>\n\n\n\n
IV. Add Your SSL Certificate and Private Key<\/h3>\n\n\n\n
Create the new certificate file and paste in your certificate content:<\/p>\n\n\n\n
vi \/usr\/local\/vesta\/ssl\/certificate.crt\n<\/pre>\n\n\n\n
Create the new key file and paste in your private key content:<\/p>\n\n\n\n
vi \/usr\/local\/vesta\/ssl\/certificate.key\n<\/pre>\n\n\n\n
\n
Security note:<\/strong> Never share your private key file or paste it into any tool or service you don’t fully trust \u2014 anyone with access to it can impersonate your server’s identity for any client that trusts the certificate.<\/p>\n<\/blockquote>\n\n\n\n
V. Add the CA Bundle (Commonly Missed Step)<\/h3>\n\n\n\n
This is the step a lot of quick-reference guides skip, and it’s a common cause of “certificate not fully trusted” warnings even after installing a real certificate. Most certificates issued by a commercial CA (and some free ones) require an intermediate certificate bundle to complete the trust chain \u2014 without it, some browsers and most command-line tools (like
curl<\/code>) will flag the connection as untrusted, even though the certificate itself is valid.<\/p>\n\n\n\nIf your CA provided a bundle file (commonly named something like
ca-bundle.crt<\/code> orintermediate.crt<\/code>), add it as:<\/p>\n\n\n\nvi \/usr\/local\/vesta\/ssl\/certificate.ca\n<\/pre>\n\n\n\n
Paste the CA bundle content provided by your certificate authority.<\/p>\n\n\n\n
\n
If you’re using a free certificate from Let’s Encrypt, this is typically the
chain.pem<\/code> orfullchain.pem<\/code> content depending on how it was issued \u2014 check your certificate provider’s documentation for the exact filename if you’re unsure which file serves this role.<\/p>\n<\/blockquote>\n\n\n\nVI. Set Correct File Permissions<\/h3>\n\n\n\n
The private key in particular should be tightly restricted, since it’s the file that actually protects your certificate’s security:<\/p>\n\n\n\n
chmod 600 \/usr\/local\/vesta\/ssl\/certificate.key\nchown root:root \/usr\/local\/vesta\/ssl\/certificate.key\n<\/pre>\n\n\n\n
VII. Verify the Certificate and Key Actually Match<\/h3>\n\n\n\n
Before restarting VestaCP, it’s worth confirming the certificate and private key are actually a matching pair \u2014 a mismatch here (for example, from pasting the wrong key) will cause VestaCP to fail to start correctly or serve an unusable certificate.<\/p>\n\n\n\n
openssl x509 -noout -modulus -in \/usr\/local\/vesta\/ssl\/certificate.crt | openssl md5\nopenssl rsa -noout -modulus -in \/usr\/local\/vesta\/ssl\/certificate.key | openssl md5\n<\/pre>\n\n\n\n
If both commands output the same hash, the certificate and key match correctly.<\/p>\n\n\n\n
VIII. Restart VestaCP<\/h3>\n\n\n\n
Apply the new certificate by restarting the service:<\/p>\n\n\n\n
service vesta restart\n<\/pre>\n\n\n\n
IX. Verify in the Browser<\/h3>\n\n\n\n
Open the VestaCP panel using your domain:<\/p>\n\n\n\n
https:\/\/domain.tld:8083\n<\/pre>\n\n\n\n
You should see the secure padlock icon in the browser’s address bar, confirming the new certificate is active and trusted.<\/p>\n\n\n\n
X. Troubleshooting Common Issues<\/h3>\n\n\n\n
Browser still shows a security warning after restarting:<\/strong> This is most often the missing CA bundle from Step V. Confirm
certificate.ca<\/code> exists and contains your CA’s intermediate certificate.<\/p>\n\n\n\nVestaCP fails to restart after adding the new certificate:<\/strong> Re-check Step VII \u2014 a mismatched certificate\/key pair is the most common cause. Also confirm there’s no extra whitespace or missing
-----BEGIN CERTIFICATE-----<\/code> \/-----END CERTIFICATE-----<\/code> markers from a copy-paste error.<\/p>\n\n\n\n“Permission denied” errors on restart:<\/strong> Double check the permissions and ownership set in Step VI \u2014 VestaCP needs to be able to read the key file as the user the service runs under.<\/p>\n\n\n\n
XI. Conclusion<\/h3>\n\n\n\n
Installing a real SSL certificate for VestaCP comes down to replacing three files \u2014 the certificate, the private key, and (commonly overlooked) the CA bundle \u2014 verifying the certificate and key actually match before restarting, and setting correct permissions on the private key. With those in place, VestaCP’s admin panel serves a fully trusted, browser-validated HTTPS connection instead of the default self-signed warning.<\/p>\n\n\n\n
\n\n\n\nFrequently Asked Questions<\/h2>\n\n\n\n
Do I always need a CA bundle file?<\/strong> It depends on your certificate authority \u2014 some certificates are issued with the intermediate chain already bundled into the main certificate file, while others require it separately. If browsers still show a trust warning after installing your certificate and key, a missing CA bundle is the most likely cause.<\/p>\n\n\n\n
Can I use a free Let’s Encrypt certificate for this instead of a paid one?<\/strong> Yes \u2014 the same three files (certificate, key, and CA bundle) apply regardless of which certificate authority issued them; you’d just source the equivalent files from your Let’s Encrypt client’s output instead of a paid CA’s delivery portal.<\/p>\n\n\n\n
What happens to my old self-signed certificate after this?<\/strong> It’s preserved under the
_old<\/code> filenames from Step III and no longer in active use \u2014 you can safely delete those backup files later once you’ve confirmed the new certificate is working correctly.<\/p>\n\n\n\n
\n\n\n\nTalk to Our Technology Experts<\/h2>\n\n\n\n
Managing SSL certificates or hardening your control panel setup? Our team can help with server security, SSL\/TLS configuration, control panel administration, and ongoing infrastructure support.<\/p>\n\n\n\n
Connect with our technology experts.<\/a><\/p>\n\n\n\n
Related Articles<\/h2>\n\n\n\n
- \n
- Install phpMyAdmin on Ajenti Control Panel<\/a><\/li>\n\n\n\n
- Change SSH Default Port and Disable SSH Root Login<\/a><\/li>\n<\/ul>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Introduction This guide explains how to install an SSL certificate for VestaCP, replacing the self-signed certificate VestaCP uses by default […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"jetpack_post_was_ever_published":false},"categories":[1024],"tags":[277,344],"class_list":["post-2008","post","type-post","status-publish","format-standard","hentry","category-security","tag-ssl","tag-vestacp","psol-cat-security"],"jetpack_publicize_connections":[],"jetpack_shortlink":"https:\/\/wp.me\/phn2x7-wo","jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2008","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/comments?post=2008"}],"version-history":[{"count":2,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2008\/revisions"}],"predecessor-version":[{"id":11419,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/posts\/2008\/revisions\/11419"}],"wp:attachment":[{"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/media?parent=2008"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/categories?post=2008"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/pheonixsolutions.com\/blog\/wp-json\/wp\/v2\/tags?post=2008"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Change SSH Default Port and Disable SSH Root Login<\/a><\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/pheonixsolutions.com\/blog\/wp-content\/uploads\/2017\/09\/vestacp_ssl_architecture-scaled.png\")
<\/a><\/figure>\n\n\n\n