This plugin drives Certbot from the panel to issue, renew, revoke, and delete Let's Encrypt certificates. It lists the certificates present on a node with their expiry, and can suggest issuable domains drawn from the panel's own websites. Issuance covers the bare domain plus optional www, additional SANs typed into the form, wildcard requests via DNS-01, and a staging mode for dry runs against Let's Encrypt's test environment. When a certificate is obtained for a panel-managed website, the plugin also regenerates that site's vhost so it actually serves the certificate on :443 with an HTTP-to-HTTPS redirect — obtaining a certificate and serving it are separate steps, and both are done here.

The plugin is node-aware: for a domain served by a remote node, the Certbot run, the authenticator detection, and the on-demand install of the nginx or Apache Certbot plugin all happen on that node rather than on the panel host. Website owners get a restricted set of actions covering only their own domains, with the authenticator and webroot forced server-side so a tenant cannot point a challenge at an arbitrary path. Separately from Certbot's own renewal timer, the plugin installs a daily expiry check via /etc/cron.d/vinza-letsencrypt that warns by panel notification and optionally by email; it alerts when a certificate first enters the warning window or when its severity worsens, rather than repeating the same message every morning. Two limits are worth knowing: that expiry check inspects the panel host only and does not cover remote nodes, and issuance is throttled by a ninety-second per-domain, per-node cooldown so repeated clicks cannot burn Certbot's rate limits. It requires certbot on the server, which the install script fetches via snap or apt.