Visitors hesitate to order from, or leave a phone number on, a site the browser labels "Not secure". An SSL certificate encrypts traffic between the site and the visitor and moves the address to https://. Let's Encrypt certificates are free, valid for 90 days, and ISPmanager renews them automatically before they expire, so a correct one-time setup is usually all you need.
Before you start: the domain must point to the server
Let's Encrypt verifies ownership by requesting a challenge file over HTTP from the IP in your domain's A record. If the domain still points to the old host, DNS has not propagated, or port 80 is closed, issuance fails. Check first:
dig A misol.uz +short
dig A www.misol.uz +short
curl -I http://misol.uzBoth lookups should return your hosting server's IP. If you recently changed nameservers in the sayt.uz cabinet, allow a few hours for propagation.
Issuing the certificate
In ISPmanager open SSL certificates and choose to create a Let's Encrypt certificate. Select your site as the domain, make sure www.misol.uz is included as an alias, and enter an email for notices. A wildcard option for *.misol.uz may exist, but it is validated through DNS and may not work if your DNS is not hosted on the server. Within a few minutes the certificate should appear as active. If the status stays at "requested" for a long time or shows an error, do not keep re-creating it; read the troubleshooting section below first.
Remember that every hostname you want to protect has to be listed. A certificate for misol.uz alone does not cover www.misol.uz or shop.misol.uz, and visitors on an uncovered name will see a certificate warning even though the main domain works fine.
Attaching it and redirecting to HTTPS
ISPmanager usually attaches the new certificate automatically, but check once: edit your domain under Sites (or WWW domains), confirm that SSL is enabled with the new Let's Encrypt certificate selected, and enable the HTTP to HTTPS redirect. If an HSTS option is offered, enable it only after you have seen at least one successful renewal, because a broken certificate with HSTS locks visitors out completely.
Example: a school site with mixed content
A private school in Namangan runs WordPress on misol.uz. After installing the certificate, the padlock shows a warning because images and scripts are still stored with http:// URLs. Change the site address in WordPress settings to https://misol.uz, back up the database, then update old links with WP-CLI:
wp search-replace 'http://misol.uz' 'https://misol.uz' --all-tables --dry-run
wp search-replace 'http://misol.uz' 'https://misol.uz' --all-tablesThe first command only reports what would change; the second applies it.
Why issuance fails
The usual causes are DNS pointing elsewhere (often only the www record), .htaccess rules that block or redirect /.well-known/acme-challenge/, a proxy such as Cloudflare intercepting the check, or a CAA record that does not allow Let's Encrypt. Let's Encrypt also rate-limits failed attempts, so fix the cause before retrying instead of clicking the button repeatedly. If you are stuck, send a ticket to sayt.uz support with the domain and the exact error.
Verifying the certificate
echo | openssl s_client -connect misol.uz:443 -servername misol.uz 2>/dev/null | openssl x509 -noout -issuer -datesThe output shows the issuer and the notBefore and notAfter dates. If expiry is days away and renewal has not happened, check whether DNS changed or the challenge path became blocked, since renewals go through the same validation as the first issuance.