How to Reinstall SSL in CyberPanel (GUI & CLI)

Managing SSL certificates in CyberPanel is typically automated thanks to its built-in ACME client integration with Let’s Encrypt. However, certain scenarios—such as migrating DNS records, getting stuck with a self-signed fallback certificate, or encountering renewal failures—can cause SSL errors on your domain.

When web browsers trigger security warnings like NET::ERR_CERT_COMMON_NAME_INVALID or SEC_ERROR_EXPIRED_CERTIFICATE, the most effective resolution is to perform a clean SSL reissue.

This guide explains two reliable methods to reinstall SSL in CyberPanel: via the Web GUI Dashboard and via the SSH Command Line Interface (CLI). We will start with the general commands using yourdomain.com, followed by practical examples using a real-world subdomain: cyberpanel.masdzub.com.

Prerequisites Before Reissuing SSL

Before running any SSL reissuance commands, ensure the following foundational requirements are met:

DNS A Record is Properly Pointed: Ensure your domain (yourdomain.com) resolves directly to your server’s public IP address.

General verification command:
Terminal window
```
dig +short yourdomain.com
```
Example for cyberpanel.masdzub.com:
Terminal window
```
dig +short cyberpanel.masdzub.com
```
Ports 80 and 443 are Open: Let’s Encrypt validates domain ownership via the HTTP-01 challenge over port 80 and delivers encrypted traffic over port 443. Ensure no firewall rules (UFW, CSF, or Cloud Security Groups) block inbound traffic on these ports.
Temporarily Disable Cloudflare Proxy (If Applicable): If your DNS is managed via Cloudflare, change the proxy status from Proxied (Orange Cloud) to DNS Only (Grey Cloud) before requesting the certificate. This ensures Let’s Encrypt ACME challenge requests hit your CyberPanel server directly instead of Cloudflare’s edge servers.

Method 1: Reinstall SSL via Web GUI Dashboard

If you prefer using a graphical interface, CyberPanel allows you to reissue certificates directly from the control panel dashboard.

A. For Standard Websites and Subdomains

Open your browser and log in to your CyberPanel dashboard:
```
https://<your-server-ip>:8090
```
In the left navigation menu, expand the SSL section and click Manage SSL.
Under Select Website, choose your domain from the dropdown menu (e.g., yourdomain.com).

Example: If you are fixing SSL for cyberpanel.masdzub.com, select cyberpanel.masdzub.com from the list.
Click the Issue SSL button.
Wait for the ACME validation to process. Once finished, a green notification banner will confirm that the certificate was issued successfully.

Setting Up Hostname SSL If your domain is used to access the CyberPanel admin portal itself on port 8090 (such as cyberpanel.masdzub.com:8090), use the dedicated menu at SSL → Hostname SSL, select your hostname domain, and click Issue SSL. This configures the LSCPD service to use the new SSL certificate.

Method 2: Reinstall SSL via CLI (Terminal SSH)

In situations where the GUI reports success but the site continues to serve an expired or self-signed certificate, corrupted files or cached certificates in the Let’s Encrypt live directory may be the culprit.

Using the Command Line Interface (CLI) allows you to perform a clean reinstallation by first removing the stale certificate files and then executing CyberPanel’s native issuance command.

Step 1: Connect to Your Server via SSH

ssh root@<your-server-ip>

Step 2: Remove the Old SSL Certificate Files

First, remove the existing certificate files for your domain under the /etc/letsencrypt/live/ directory.

General syntax:

rm -f /etc/letsencrypt/live/yourdomain.com/*

Example for cyberpanel.masdzub.com:

rm -f /etc/letsencrypt/live/cyberpanel.masdzub.com/*

Important Replace yourdomain.com with your actual domain name. The command above clears the existing symlinks (cert.pem, privkey.pem, chain.pem, and fullchain.pem) so CyberPanel can request a completely fresh certificate without conflicts.

If you want to perform a complete directory cleanup for that domain, you can remove the folder entirely:

# General syntax
rm -rf /etc/letsencrypt/live/yourdomain.com

# Example for cyberpanel.masdzub.com
rm -rf /etc/letsencrypt/live/cyberpanel.masdzub.com

Step 3: Run the CyberPanel Issue SSL Command

Once the previous certificate files are cleared, run CyberPanel’s built-in CLI command to request and apply a new Let’s Encrypt certificate:

General syntax:

cyberpanel issueSSL --domainName yourdomain.com

Example for cyberpanel.masdzub.com:

cyberpanel issueSSL --domainName cyberpanel.masdzub.com

This command triggers CyberPanel’s automated ACME workflow:

Creates the ACME challenge file in /.well-known/acme-challenge/.
Contacts Let’s Encrypt to validate domain ownership.
Downloads the fresh certificates and keys.
Updates the OpenLiteSpeed virtual host configuration.

Step 4: Restart Web Server Services

Restart OpenLiteSpeed and the CyberPanel daemon to ensure all active services load the newly generated certificate files into memory:

systemctl restart lsws
systemctl restart lscpd

Verifying the New SSL Certificate

Once the installation completes, verify that your domain is serving the newly issued certificate.

1. Verify via Terminal (OpenSSL)

Run the following command to check the certificate issuer and expiration date:

General syntax:

echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -dates -issuer

Example for cyberpanel.masdzub.com:

echo | openssl s_client -servername cyberpanel.masdzub.com -connect cyberpanel.masdzub.com:443 2>/dev/null | openssl x509 -noout -dates -issuer

Expected Output Details:

issuer: Should show Let’s Encrypt (e.g., CN = R10 or CN = R11), indicating it is a genuine, trusted CA certificate and not a self-signed fallback.
notAfter: Should reflect an expiration date 90 days from the issue date.

2. Verify in Your Web Browser

Open your browser and navigate to:

https://yourdomain.com
# Example:
https://cyberpanel.masdzub.com

Click the padlock icon next to the URL in the address bar. The browser should report that the connection is secure and verified by Let’s Encrypt.

Troubleshooting Common Issues

If the SSL issuance does not succeed, investigate these common causes:

Check ACME Logs: Review the Let’s Encrypt ACME logs to see the exact validation error:

tail -n 50 /root/.acme.sh/acme.sh.log
# Or check CyberPanel general logs:
tail -n 100 /home/cyberpanel/error-logs.txt

Check .htaccess Redirects: Rules that force HTTPS or enforce trailing slashes can redirect Let’s Encrypt validation bots unexpectedly. Ensure that requests to /.well-known/acme-challenge/ are exempt from rewriting.
Let’s Encrypt Rate Limits: Let’s Encrypt enforces a limit of 5 failed validations per hostname per hour. If multiple attempts fail consecutively, wait an hour before trying again to avoid triggering a temporary block.

Conclusion

Reissuing an SSL certificate in CyberPanel can be accomplished through the GUI for routine maintenance, but using the CLI provides complete control when dealing with corrupted or stuck certificates. By first deleting the old files in /etc/letsencrypt/live/yourdomain.com/* and then executing cyberpanel issueSSL --domainName yourdomain.com, you guarantee a clean and reliable SSL installation every time.

Written by Dzubayyan Ahmad | System Administrator & SRE