Creating SSL Certificates

Introduction

If the Panel uses HTTPS, Wings must too, because browsers do not let a secure page connect to an insecure service. You usually need one certificate for the Panel's domain and one for each node's domain.

This guide uses Certbot to get free certificates from Let's Encrypt. Certbot stores each one in /etc/letsencrypt/live/<domain>/, where the Panel's web server configurations and Wings expect it.

Caddy gets and renews the Panel's certificate itself. If you use Caddy, you only need this guide for your nodes.

Installing Certbot

Install Certbot and the plugin for your web server:

apt update
# For NGINX:
apt -y install certbot python3-certbot-nginx
# For Apache:
apt -y install certbot python3-certbot-apache

On a node without a web server, install certbot on its own.

Creating a Certificate

Let's Encrypt verifies that you control the domain by connecting to it on port 80. The domain must point at the server, and port 80 must be open.

For the Panel, use your web server's plugin. --deploy-hook reloads the web server after each renewal so it uses the new certificate. Replace panel.example.com with your Panel's domain:

# NGINX:
certbot certonly --nginx -d panel.example.com --deploy-hook "systemctl reload nginx"
# Apache:
certbot certonly --apache -d panel.example.com --deploy-hook "systemctl reload apache2"

For a node without a web server, Certbot runs a temporary web server on port 80, now and at each renewal. Wings reads its certificate at startup, so the hook restarts it:

certbot certonly --standalone -d node.example.com --deploy-hook "systemctl restart wings"

If the Panel and Wings share a server and a domain, one certificate serves both. Create it with your web server's plugin and both hooks: --deploy-hook "systemctl reload nginx && systemctl restart wings".

Using Cloudflare

If your domain uses Cloudflare's proxy, or port 80 is not reachable, Let's Encrypt cannot connect to your server. Certbot can instead prove that you control the domain by adding a DNS record through Cloudflare's API.

Create an API token: in the Cloudflare dashboard, open My Profile → API Tokens, click Create Token, and use the Edit zone DNS template. Under Zone Resources, select your domain, then create and copy the token.

Install the Cloudflare plugin and save the token in a file only root can read:

apt -y install python3-certbot-dns-cloudflare
mkdir -p /root/.secrets
echo "dns_cloudflare_api_token = <your token>" > /root/.secrets/cloudflare.ini
chmod 600 /root/.secrets/cloudflare.ini

Create the certificate:

certbot certonly --dns-cloudflare --dns-cloudflare-credentials /root/.secrets/cloudflare.ini -d panel.example.com --deploy-hook "systemctl reload nginx"

Renewing Certificates

Let's Encrypt certificates last 90 days. The Certbot package includes a timer that renews them before they expire and runs each certificate's deploy hook. To test renewal, run:

certbot renew --dry-run

If a certificate has expired, browsers show an insecure connection error for the Panel, or the Panel cannot connect to Wings. Run certbot renew, then reload your web server and restart Wings.