Setup guide

Plesk setup guide for sslcertificates.io

Connect Plesk to sslcertificates.io to discover subscriptions and domains, import replacement certificates, bind them to sites, reload services, verify public TLS endpoints, roll back on failure, and repeat the path on renewal.

What this integration does

Plesk deployment uses the Plesk XML/API RPC interface. After you authenticate, sslcertificates.io lists subscriptions and domains you are permitted to see, reads the current certificate binding, installs a replacement PEM (leaf, chain, and private key according to your key mode), binds the certificate to the site, reloads or applies configuration as required, verifies the public HTTPS fingerprint when configured, stores the previous certificate for rollback, and runs the same flow when a renewal order completes.

Public integration page: /integrations/plesk.

Prerequisites

A Plesk server you administer (Obsidian or supported version documented by Plesk).
HTTPS access from sslcertificates.io to your Plesk management URL (typically port 8443).
An API key or secret restricted to subscriptions you intend to automate — not the full server admin password unless no alternative exists.
Hostnames on those subscriptions that resolve publicly when you want external TLS verification.

Authentication

The connection form expects:

Plesk host — hostname or URL reachable from sslcertificates.io (no trailing path).
API secret key — created in Plesk for a limited user or subscription.
Protocol — optional; defaults to HTTPS.

Create the key in Plesk under Extensions → API or the documented RPC key workflow for your version. Map the key to a service user that owns only the subscriptions you select during discovery. Keys are encrypted at rest in sslcertificates.io and are shown only once at save.

Prefer subscription-scoped API users over global administrator keys. Administrator keys increase blast radius if leaked.

Permissions

The platform must not receive credentials that can modify unrelated subscriptions. Grant:

Read subscriptions and domains for discovery.
Install and bind certificates on selected domains.
Reload web server / domain configuration where the API exposes it.

If an API user can only read certificates, deployment will fail after issuance — scope write access deliberately.

Plesk documentation: https://docs.plesk.com/en-US/obsidian/api-rpc/

Connect in sslcertificates.io

Open Workspace → Integrations → Plesk.
Enter host, API key, and protocol if non-default.
Test connection — must succeed before discovery.
Discover subscriptions and domains; select resources for this organization.
Link deploy actions to certificate orders or auto-deploy rules in your runbook.

Subscriptions and domains

Discovery enumerates subscriptions the credential may list. Each subscription contains one or more domains (websites). Select only domains whose TLS lifecycle this organization owns. Multi-tenant hosts should separate customers by organization in sslcertificates.io — never share API keys across tenants.

Certificate import and key handling

Orders may use platform-generated keys (private key encrypted at rest in sslcertificates.io, included in deploy payload) or customer CSR mode (private key never leaves your HSM — only the signed leaf and chain deploy). Choose key mode at order time; Plesk install must match what the site expects.

The connector uploads PEM material Plesk accepts for the domain. Split fullchain and leaf if your runbook requires it — the integration follows the catalog contract tested against Plesk RPC.

Never paste production private keys into email or tickets. Download audited key material only through /api/v1/certificates/{id}/download when policy allows.

Binding and deployment

Installing a certificate is not complete until Plesk binds it to the site and the web server serves it on 443. The integration calls bind/install operations exposed by the RPC layer for the selected domain.

HTTP 200 from Plesk is necessary but not sufficient. Success is a TLS handshake showing the new leaf SHA-256 on the public hostname.

Configuration validation and reload

Where supported, the connector triggers configuration test and reload/graceful restart paths appropriate to Plesk (Apache/nginx behind Plesk). Failed config tests should abort before cutting over traffic — use rollback material if a half-applied cert would break the vhost.

External verification

After deploy, sslcertificates.io may probe https://your-hostname/ and compare the served certificate fingerprint to the expected leaf. Mismatch marks deploy as failed even when Plesk reported success — investigate binding, SNI, or cached old cert paths.

Use /tools/expiry-checker or openssl s_client -connect host:443 -servername host as an independent check.

Rollback

The integration retains the previous certificate material where the contract allows .prev rollback. If verification fails, restore the prior cert via rollback in the workspace or manual Plesk UI before debugging the new order.

Document rollback steps in your change management — especially on shared hosting with many vhosts.

Renewal

When auto_renew triggers or you POST /api/v1/certificates/{id}/renew, a new order validates and issues. The Plesk connector should deploy the replacement automatically if you configured deploy-on-issue. Renewals fail operationally when issuance succeeds but deploy does not — watch certificate.renewal_failed and verify HTTPS after every renewal.

Test renewals on Let's Encrypt Staging before Live Production renewals hit customer traffic.

Test vs Live

Use a Test API key and Let's Encrypt Staging on a disposable domain in a non-production subscription. Prove discovery, install, bind, verify, and rollback without publicly trusted leaves.

Switch to Live API keys and Production CA only when Staging deploy and verify succeeded end-to-end.

Common errors

Symptom	Likely cause	Action
Test connection TLS error	Host/firewall blocks 8443	Allow sslcertificates.io egress to management URL
401/403 on RPC	Revoked or wrong API key	Regenerate key in Plesk; update integration
Discovery empty	User lacks subscription list	Widen read scope temporarily
Install OK, verify fail	Wrong domain binding or SNI	Re-bind cert; check additional domains
Renewal loop	Deploy skipped	Enable deploy hook; check renewal_failed
`insufficient_scope` on API	Missing abilities on API key	Add certificates:write to sslcertificates.io key

Stable platform codes: /docs/errors. Plesk-side errors appear in integration run logs in the workspace.

Disconnect

Disconnect removes stored Plesk credentials for the organization. It does not uninstall certificates on the server. Rotate the Plesk API key after disconnect if a teammate had access.

Credential rotation

Create a new Plesk API key, update the integration, Test connection, revoke the old key in Plesk, and confirm scheduled renewals still deploy.

Continue

Back to Plesk Create account