SSL Manager handles the certificates Let's Encrypt cannot: ones you bought from a CA, or self-signed ones for internal and staging sites. You paste the certificate, the private key and (optionally) the CA chain; the plugin parses and validates the bundle — checking that the key matches the certificate and that the domain is covered — before deploying anything, and returns warnings for things like an expiring or self-signed cert without refusing the install. It can also generate a CSR plus private key for you to send to a CA (nothing is stored server-side, so you must save the key yourself), or generate and install a self-signed certificate with a configurable validity of 1 to 3650 days.

Deployment works without any core changes: the real files are written to /etc/vinzapanel/ssl/DOMAIN/ and symlinked into /etc/letsencrypt/live/DOMAIN/, which is the path the panel's vhost templates already hard-code, so the certificate survives vhost regeneration. The panel's normal SSL provisioner is then called to flip the vhost to HTTPS. The plugin refuses to install over a domain certbot already manages — an existing renewal profile means you must revoke the Let's Encrypt cert first — and on removal it only unlinks symlinks that point back into its own store, so a genuine certbot setup is never disturbed. Every action is scoped to a domain the caller owns, with website owners getting the same surface as admins for their own sites, and each request is routed to the node that hosts that site. Certificate metadata (issuer, expiry, days left) is cached on the website record so the list view renders without touching the node, and a health check flags managed certificates with 14 days or less remaining. Renewal is not automated — a custom certificate must be replaced by hand when it expires.