How to secure Webmin with a Lets Encrypt SSL certificate?

Updated: 11 October 2026 · Applies to: Webmin 2.670

Webmin creates its own certificate, so browsers show a warning when you open it. You can replace it with a free Let's Encrypt certificate for a domain name that points to your server. Webmin can request and renew the certificate itself. The menu names below can differ a little between Webmin versions.

Before you start

1. A domain name for the server, such as panel.example.com, with an A record that points to the server's IP address. Let's Encrypt does not issue certificates for IP addresses.
2. A web server on port 80 that serves that domain. Let's Encrypt checks ownership by fetching a file from /.well-known/acme-challenge/ in the website's folder, so Apache or Nginx must answer for the domain and you need to know its document root folder (for example /var/www/html).
3. Port 80 open in the firewall.

Request the certificate

1. Log in to Webmin.
2. Open Webmin › Webmin Configuration › SSL Encryption and select the Let's Encrypt tab.
3. In Hostnames for certificate enter the domain name, for example panel.example.com.
4. In Website root directory for validation file choose Other directory and enter the document root of the website that answers for that domain.
5. Tick the option to copy the new key and certificate to Webmin, so Webmin uses it.
6. Set the renewal interval. Let's Encrypt certificates are valid for at most 90 days, and Webmin's documentation suggests a renewal every 2 months.
7. Click Request Certificate. Wait for the success message.
8. Open Webmin with the domain name: https://panel.example.com:10000. The padlock should appear without a warning.

Let's Encrypt limits how often certificates can be requested for one domain. While you are still trying, do not repeat the request many times; if you use Webmin's option for the test (staging) server, no limit applies, but staging certificates are not trusted by browsers.

If the request fails

• "Failed to request certificate" or validation errors: open http://panel.example.com/.well-known/acme-challenge/test from outside; it must reach your web server's document root. Check the folder name and DNS.
• No web server on this machine: install one (for example sudo apt install -y nginx) or use your existing one.
• Firewall: port 80 must be reachable from the internet.
• The warning is still shown: you may still open Webmin by IP address. Certificates match the domain name, not the IP address.

Use your own certificate instead

If you already have a certificate and key (for example from your certificate authority), open Webmin › Webmin Configuration › SSL Encryption, use the SSL Settings tab and enter the paths of the key and certificate files, then restart Webmin (sudo systemctl restart webmin). The SSL Encryption page is also where you switch SSL mode on or off and generate a new self-signed certificate.

Frequently asked questions

Does the certificate renew by itself?
Yes, if you set an automatic renewal interval in the Let's Encrypt tab. Check the expiry date in your browser every few months at first.

Can I put Webmin behind Nginx or Apache with HTTPS instead?
Yes. Webmin documents reverse proxy setups for both. Then the proxy serves the certificate.

Official documentation: Webmin documentation: Webmin Configuration.

Need a server for Webmin, or a hand with the setup?

• Managed Webmin VPS: a KVM VPS with Webmin where updates, security and monitoring are handled for you.
• KVM VPS with NVMe storage: full root access, so you can install and manage Webmin yourself.

Prefer a hand with the setup? Our engineers can do it for you: Hire an Expert, or use our on-demand server management.