Set up Let's Encrypt and AutoSSL in InterWorx: NodeWorx and SiteWorx

InterWorx doesn't sign SSL server-wide the way cPanel's AutoSSL does. Certificates are issued per SiteWorx domain, the Let's Encrypt integration has to be switched on in NodeWorx first, and the panel's own login page at :2443 is a separate certificate from anything a customer's domain gets. None of it is hard, but the three-layer structure — plugin, domain, service — is where people get stuck.

This covers all three: turning on the plugin, issuing a certificate for a hosted domain from SiteWorx, and putting a real certificate on the panel login itself so :2443 stops throwing browser warnings. If you're still setting up the server, the AlmaLinux 9 install walkthrough covers everything upstream of this.

Enable the Let's Encrypt plugin in NodeWorx

The plugin ships with InterWorx but starts disabled. Turn it on before any SiteWorx user can see the option:

1. Log into NodeWorx at https://ip.ad.dr.ess:2443/nodeworx.
2. Go to NodeWorx → Plugins, find Let's Encrypt in the SSL section, and click the pencil icon to edit it.
3. Set Status to Enabled.
4. Set Mode to Staging first, not Live — more on why below.
5. Enter an email address. This is where expiry and renewal-failure notices go, not the customer's address.
6. Save.

AutoSSL is a separate toggle in the same form. Turning it on generates and renews Let's Encrypt certificates automatically for any SiteWorx account that has SSL enabled in its account settings — it doesn't touch accounts where SSL is off, and it doesn't override a paid certificate a customer has already installed.

Issue a certificate for a hosted domain

This is the SiteWorx-side flow, and it's what most account holders will use directly:

1. Log into SiteWorx and go to Hosting Features → Domains → Manage.
2. Click the shield icon next to the domain to open its SSL Certificates page.
3. Click Generate All With Let's Encrypt.
4. Pick the Primary Domain, tick any Additional Domains (subdomains and the www. variant most commonly), enter an Email Address, and choose Mode — Staging to test, Live to issue a browser-trusted certificate.
5. Click Generate.

InterWorx handles the CSR, HTTP-01 validation, and installation in one pass. The domain has to resolve to an IP that's actually on the server — Let's Encrypt's validation request hits the domain over HTTP, and if it lands on a different box (stale DNS, a CDN not yet configured to pass validation through, or a domain that hasn't propagated) the request fails with no certificate issued.

If you'd rather not depend on Let's Encrypt for a given domain — an EV certificate for a customer with compliance requirements, say — the same shield icon has Setup Private Key → Setup CSR → Setup SSL Certificate for installing a certificate from a paid CA, or for generating a self-signed one when nothing else is needed.

Secure the panel login itself

The domain certificate above covers https://customerdomain.com. It does nothing for https://server1.example.com:2443, which is a separate service certificate:

1. Create a SiteWorx domain that matches the server's actual hostname (e.g. server1.example.com), if one doesn't already exist.
2. Issue a Let's Encrypt certificate for that domain using the SiteWorx flow above.
3. Back in NodeWorx, go to Server → SSL Certificates.
4. Click Update Service Certificates, set the certificate source to Domain, and select the hostname domain from step 1.
5. Choose which services get the certificate — at minimum NodeWorx and SiteWorx — and save.

Without this, admins and resellers hit a self-signed-certificate warning every time they log in, which is exactly the kind of thing that makes a reseller's own customers doubt the platform.

What AutoSSL renews, and what it won't

AutoSSL re-issues before the standard 90-day Let's Encrypt expiry, but only for domains where SSL is enabled at the account level and where the domain still resolves to the server. It will not:

• Renew a certificate on a domain that's been pointed elsewhere (a CDN, a different server) since issuance — the HTTP validation will simply fail silently in the renewal job's log.
• Touch a paid CA certificate a customer installed manually. Those renew on the CA's own schedule, outside InterWorx.
• Renew the panel's service certificate automatically. That one was issued through a SiteWorx domain, so it does renew when AutoSSL processes that domain — but if you ever remove or rename the hostname domain, the service certificate stops updating and nobody notices until it expires.

The failure that isn't obvious: CAA records

If a domain has a CAA DNS record — increasingly common on domains migrated from providers that set one by default — and it doesn't list letsencrypt.org as an authorized issuer, every Let's Encrypt request for that domain fails validation. This isn't an InterWorx bug; every CA has been required to honor CAA records since 2017. Check for one before assuming the plugin is broken:

dig CAA example.com +short

If it returns nothing, there's no CAA restriction and this isn't the problem. If it returns entries that don't include letsencrypt.org, add one at whichever DNS provider is authoritative for the zone — not necessarily NodeWorx, if the domain's nameservers point elsewhere.

Next steps

• Install InterWorx on AlmaLinux 9 — the full setup path if the plugin above isn't showing up yet.
• InterWorx clustering setup guide — certificates and DNS considerations change once NodeWorx is managing more than one node.
• Fix InterWorx license errors — if activation itself is the blocker, not SSL.