Last updated on August 26th, 2026 at 11:47 am
The main lesson: Hestia’s control-panel hostname certificate is managed at the server level. It may not appear inside any hosted user account, even though the panel uses it for HTTPS.
What I learned
An invalid certificate on the panel hostname does not automatically mean the DNS record or website account is wrong. If the hostname points to the correct server but the certificate has expired, the fix belongs in Hestia’s server-level certificate setup.
How to check and renew it
- Confirm the hostname. Run
hostname -f. The result should be the fully qualified hostname used to open the panel. - Check DNS. Confirm that the hostname’s A or AAAA record points to this server. Let’s Encrypt must be able to reach the correct machine.
- Inspect the certificate. Check the certificate served by the panel port and note its expiry date. This separates an expired certificate from a hostname mismatch.
- Request the Hestia host certificate. As root, run
v-change-sys-hostname host.example.comonly if the system hostname is wrong. Then runv-add-letsencrypt-host. - Verify the result. Reconnect to the panel and confirm that the certificate hostname and expiry date are correct.
Common problems and fixes
- Cause: The hostname points to another server. Fix: Correct DNS before requesting the certificate.
- Cause: The hostname is not the server’s full hostname. Fix: Set the correct fully qualified hostname first.
- Cause: Let’s Encrypt validation fails. Fix: Inspect the relevant log in
/var/log/hestia/and resolve the reported DNS, reachability, or rate-limit error. - Cause: The domain is missing from customer accounts. Fix: Treat the panel hostname separately; it is server-level configuration.
Conclusion
When the Hestia panel shows an expired certificate, first verify the hostname and DNS, then renew the dedicated host certificate. The concrete next action is to check hostname -f before changing any account-level web domain.