DocsICP FilingConsole
Documentation
Home Page Certificate Management Service SSL certificate management Deploy SSL certificates Deploying certificate manually Install an international SSL certificate Install an SSL certificate on BT-Panel

Install an SSL certificate on BT-Panel (Linux)

Updated at:
Copy as MD
Product
My Favorites

This topic describes how to configure an SSL certificate on BT-Panel and verify the installation. After configuration, you can securely access your application over an encrypted HTTPS channel to ensure data transmission security.

Prerequisites

  • You have purchased and applied for a certificate by using the SSL Certificates Service, and its Status is Issued. To purchase and apply for a certificate, see Purchase a paid certificate and Apply for a certificate.

  • Your domain name is correctly resolved to the current server, and you have completed the MIIT ICP filing (for servers in the Chinese mainland).

    How to check DNS records and ICP filing information

    Open the Network Probe Tool, select Network Diagnostic Analysis, enter your domain name, and confirm the following information:

    • In the DNS Provider Resolution Result section, the IP address in the A record is the public IP address of your server.

    • The ICP Filing Check status is ICP Filed. If the status is "The website is not ICP filed. Please contact the website server provider.", you must complete the ICP filing before you install the certificate.

  • BT-Panel is installed on the server. If it is not yet installed, see the Install BT-Panel on Linux documentation.

    Note

    • If your server is an Alibaba Cloud ECS instance, you can quickly install BT-Panel by following the instructions in Deploy BT-Panel.

    • For more information about installing and using BT-Panel, visit the official BT-Panel website.

Procedure

Step 1: Download the SSL certificate and private key files

  1. On the SSL Certificates page, find the certificate you want to deploy and confirm the following information:

    1. Certificate Status: Make sure that the status is Issued. If the status is About to Expire or Expired, you must renew the SSL certificate.

    2. Bound Domains: Make sure that the certificate covers all domain names that you want to protect. Otherwise, browsers show security warnings when users access unmatched domain names over HTTPS. To add or modify domain names, see Add and replace domain names.

      Verifying the domain name match

      The Bound Domains of a certificate can include multiple exact and wildcard domain names. The matching rules are as follows:

      • Exact domain name: An exact domain name certificate applies only to the specified domain name.

        • A certificate for example.com applies only to example.com.

        • A certificate for www.example.com applies only to www.example.com.

      • Wildcard domain name: A wildcard domain name certificate applies only to first-level subdomains.

        • A certificate for *.example.com applies to first-level subdomains such as www.example.com and a.example.com.

        • A certificate for *.example.com does not apply to the root domain example.com or multi-level subdomains such as a.b.example.com.

      Note

      To match a multi-level subdomain, the Bound Domains field must include the specific domain name (for example, a.b.example.com) or a corresponding wildcard domain name (for example, *.b.example.com).

  2. On the Actions column, go to the Download tab, set Server Type to Other, and then click Download.

  3. Decompress the downloaded certificate package.

    • If the package contains both a certificate file (.pem) and a private key file (.key), securely store both files. You need them for deployment.

    • If the package contains only a certificate file (.pem) and no private key file (.key), you must deploy the certificate together with the private key file that you saved locally.

      Note

      If you generated a certificate signing request (CSR) file by using a tool such as OpenSSL or Keytool when you applied for the certificate, the private key file is stored only on your local machine and the downloaded package does not contain the private key file. If the private key is lost, the certificate becomes unusable. You must purchase a paid certificate and generate a new CSR and private key.

Step 2: Open port 443 in security groups and firewalls

Before you can use an SSL certificate to support HTTPS access, make sure that the HTTPS port (port 443 by default) is open. Otherwise, you cannot access the website over HTTPS.

Open port 443

Important

If you use a non-standard port for HTTPS, open that specific port instead.

Linux

  1. Run the following command in the server terminal to check whether port 443 is open:

    RHEL/CentOS
    command -v nc > /dev/null 2>&1 || sudo yum install -y nc
# Replace <your_server_public_ip_address> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l 443 & sleep 1; nc -w 3 -vz <your_server_public_ip_address> 443

    If the output contains Ncat: Connected to <your_server_public_ip_address>:443, port 443 is open. Otherwise, you must open port 443 in the security group and firewall.

    Debian/Ubuntu
    command -v nc > /dev/null 2>&1 || sudo apt-get install -y netcat
# Replace <your_server_public_ip_address> with the public IP address of your server.
sudo ss -tlnp | grep -q ':443 ' || sudo nc -l -p 443 & sleep 1; nc -w 3 -vz <your_server_public_ip_address> 443

    If the output contains Connection to <your_server_public_ip_address> port [tcp/https] succeeded! or [<your_server_public_ip_address>] 443 (https) open, port 443 is open. Otherwise, you must open port 443 in the security group and firewall.

  2. Open port 443 in the security group.

    Important

    If your server is deployed on a cloud platform, make sure that its security group allows inbound traffic on TCP port 443. Otherwise, the service is not accessible from the internet. The following operations use an Alibaba Cloud ECS instance as an example. For other cloud platforms, see their official documentation.

    Go to the ECS Instances page and click the name of the target instance to go to its details page. For more information, see Add a security group rule. Add a rule to the security group with Action set to Allow, Protocol Type set to TCP, Port Range set to HTTPS(443), and Authorization Object set to Anywhere (0.0.0.0/0).

  3. Open port 443 in the firewall.

    Run the following command to identify the current firewall service on your system:

    if command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet firewalld; then
    echo "firewalld"
elif command -v ufw >/dev/null 2>&1 && sudo ufw status | grep -qw active; then
    echo "ufw"
elif command -v nft >/dev/null 2>&1 && sudo nft list ruleset 2>/dev/null | grep -q 'table'; then
    echo "nftables"
elif command -v systemctl >/dev/null 2>&1 && systemctl is-active --quiet iptables; then
    echo "iptables"
elif command -v iptables >/dev/null 2>&1 && sudo iptables -L 2>/dev/null | grep -qE 'REJECT|DROP|ACCEPT'; then
    echo "iptables"
else
    echo "none"
fi

    If the output is none, no further action is required. Otherwise, based on the firewall type (firewalld, ufw, nftables, or iptables), run the corresponding command to open port 443:

    firewalld
    sudo firewall-cmd --permanent --add-port=443/tcp && sudo firewall-cmd --reload
    ufw
    sudo ufw allow 443/tcp
    nftables
    sudo nft add table inet filter 2>/dev/null
sudo nft add chain inet filter input '{ type filter hook input priority 0; }' 2>/dev/null
sudo nft add rule inet filter input tcp dport 443 counter accept 2>/dev/null
    iptables
    sudo iptables -A INPUT -p tcp --dport 443 -j ACCEPT

    To prevent iptables rules from being lost after a system reboot, run the following command to make the rules persistent:

    RHEL/CentOS
    sudo yum install -y iptables-services
sudo service iptables save
    Debian/Ubuntu
    sudo apt-get install -y iptables-persistent
sudo iptables-save | sudo tee /etc/iptables/rules.v4 >/dev/null
Windows

1. Open port 443 in the security group

Important

If your server is deployed on a cloud platform, make sure that its security group allows inbound traffic on TCP port 443. Otherwise, the service is not accessible from the internet. The following operations use an Alibaba Cloud ECS instance as an example. For other cloud platforms, see their official documentation.

  1. Go to the ECS Instances page, select the region where your target ECS instance is located, and click the instance name to go to the details page.

  2. Click Security Groups > Inbound Rules and make sure a rule exists with Action set to Allow, Protocol Type set to TCP, Port Range set to HTTPS(443), and Authorization Object set to Anywhere (0.0.0.0/0).

  3. If such a rule does not exist, add one to the target security group. For more information, see Add a security group rule.

2. Open port 443 in the server firewall

  1. Log on to your Windows server, click the Start menu, and then open Control Panel.

  2. Go to System and Security > Windows Defender Firewall > Check firewall status.

  3. If the firewall is turned off as shown in the following figure, no further action is required.image

  4. If the firewall is turned on, follow these steps to allow HTTPS traffic.

    1. In the left-side navigation pane, click Advanced settings > Inbound Rules and check whether an inbound rule exists for which Protocol is TCP, Local Port is 443, and Action is Block.

    2. If such a rule exists, right-click the rule, select Properties, and on the General tab, change the action to Allow the connection. Then, click Apply.

Step 3: Log on to BT-Panel to install the SSL certificate

  1. Log on to BT-Panel in your browser.

    Note

    If you cannot log on to BT-Panel, see Failed to log on to the tower panel console for an ECS instance for solutions.

    If you have forgotten the BT-Panel URL, username, or password, you can retrieve them by using one of the following methods:

    How to find the BT-Panel URL, username, and password

    BT-Panel for Linux

    1. Log on to the server.

    2. Run a query command.

      • If this is your first time logging on to BT-Panel, run the following command to obtain the login information.

        Note

        The initial password is displayed only when you first log on to BT-Panel. Keep it secure.

        bt 14

      • If you have logged on before but forgot the password, run the following command to reset it. After the password is reset, use the new password to log on.

        bt 5

    BT-Panel for Windows

    1. Log on to the server and open the BT-Panel configuration window.

    2. In the BT-Panel for Windows Toolbox dialog box, view the BT-Panel URL.

    3. On a Windows host that has Internet access, enter the BT-Panel URL in your browser to access BT-Panel.

  2. After you log on, click Websites in the left-side navigation pane. Find the target website and click Not Deployed in the SSL Certificate column.

  3. Use a local text editor to open the certificate file (.pem) and private key file (.key) that you saved in Step 1. Copy the full content of each file and paste it into the corresponding input field.

  4. (Optional) Enable Force HTTPS: On the configuration page in Step 3, turn on the Force HTTPS switch.

    After you bind a certificate to a website, the HTTP access channel is retained by default. Directly removing HTTP access may prevent users that rely on HTTP from accessing the website normally. After Force HTTPS is enabled, all HTTP requests are automatically redirected to HTTPS, which ensures both access continuity and communication security.

  5. Click Save and Enable Certificate. After the operation is complete, the page displays the validity period of the certificate.

Step 4: Verify whether the SSL certificate is installed

  1. Access the domain bound with the certificate over HTTPS. For example, enter https://yourdomain.com (replace yourdomain.com with your actual domain name).

  2. If a padlock icon appears in the browser address bar, the certificate is successfully deployed. If you encounter access issues or the padlock icon does not appear, clear the browser cache or try again in incognito (private) mode. If the issue persists, see the FAQ section for troubleshooting.

    image

    Note

    Starting from Chrome 117, the padlock icon image in the address bar is replaced by a new tune icon image. Click this icon to view the security lock information.

    image

Next steps (Optional)

Enable domain monitoring

After the certificate is deployed, we recommend that you enable domain name monitoring. The system automatically checks the validity period of the certificate and sends reminders before the certificate expires. This helps you renew the certificate in a timely manner to prevent service interruptions. For more information, see Purchase and enable public domain name monitoring.

FAQ

The certificate does not take effect or HTTPS is inaccessible after installation or update

Common causes include:

How do I update (replace) an SSL certificate in BT-Panel?

  1. Download the new SSL certificate (.pem file) and private key (.key file) to your local machine.

  2. In the left-side navigation pane of BT-Panel, click Websites. Find the target website and click Settings in the Actions column.

  3. In the website settings dialog box, click SSL in the left-side navigation pane.

  4. In the certificate content section, paste the new certificate content to overwrite the existing content in the corresponding text box.

    1. Copy the content from the .key file and paste it into the Key (KEY) text box in BT-Panel to replace the existing content.

    2. Copy the content from the .pem file and paste it into the Certificate (PEM format) text box in BT-Panel to replace the existing content.

  5. Click Save.

Previous：Install an SSL certificate on an Nginx or Tengine server (Linux)Next：Install an SSL certificate on Apache (Linux)