Confirm the relevant extension and certificate option are available for the subscription. Check public A and AAAA records, certificate-authority restrictions in CAA, and any proxy or authentication rule that could block validation. Record the current certificate and website redirect settings.

1. Open SSL/TLS Certificates for the domain and use the available SSL It certificate request workflow.
2. Select the intended domain names, including www or webmail only when those services exist and can be validated. Use the supported wildcard workflow only when you can complete its DNS validation.
3. Review the contact address and submit the request. Read the validation result instead of repeatedly retrying the same failure.
4. Confirm the issued certificate is assigned to the website. Enable the intended HTTP-to-HTTPS redirect after HTTPS works, and check that the application generates HTTPS asset URLs.
5. Review automatic-renewal status and monitoring. Keep the required DNS and validation path available so a later renewal can succeed without an emergency change.

Visit each included hostname and inspect certificate names, trust and expiry. Test a representative form or application request over HTTPS. Confirm an external monitor can detect expiration or certificate mismatch before customers report it.

For validation failure, compare public DNS, IPv6 reachability, CAA and the actual challenge response. A CDN certificate is not proof that the origin certificate is valid. Avoid repeated requests that can encounter issuance limits; fix the identified cause first. Keep the previous valid certificate until the replacement is verified.

• Knowing when Plesk DNS changes control public records
• Securing the Plesk panel and mail-server hostnames
• Creating a subdomain website in Plesk
• Adding supported Apache and nginx directives in Plesk

• Plesk: Securing Connections With The SSL It! Extension