Install CorePanel on AlmaLinux or Rocky Linux and host your first website with free SSL

This tutorial takes a server that has nothing on it but AlmaLinux or Rocky Linux and ends with a website answering on https:// with a trusted certificate. Along the way the server gets a complete hosting stack — web server, PHP, MariaDB, mail, DNS and FTP — and a control panel to run it from.

The panel is CorePanel Personal, which is free, with no time limit, for up to 20 websites. Everything here works the same on the paid editions.

You need:

• A VPS or dedicated server with a fresh install of AlmaLinux or Rocky Linux 9 or 10, at least 2 GB of RAM (4 GB is comfortable) and 20 GB of disk, and root access over SSH.
• A domain name you can manage at your registrar. example.com stands in for it throughout, and 203.0.113.10 for the server’s public IP address.

Delegate your domain to the server

Do this first, because DNS changes take a while to spread and the rest of the tutorial runs while they do.

CorePanel works best when it is the DNS server for your domains: it then publishes every record a site and its mail need, and it can obtain one wildcard certificate that covers the website, mail., webmail. and ftp. at once. Your server becomes the domain’s nameserver in two steps at your registrar:

1. Register two nameservers, ns1.example.com and ns2.example.com, both pointing at the server’s public IP. Registrars call this Register nameservers, Personal nameservers, Host records or Glue records.
2. Switch the domain to custom nameservers and enter ns1.example.com and ns2.example.com.

Until CorePanel is installed nothing answers for the domain, which is fine: nobody is visiting it yet. Every screen and term is explained step by step in Preparing your domain.

Install CorePanel

Log in to the server as root. Bring the system up to date first:

dnf -y upgrade --refresh

Then run the installer:

curl -fsSL https://get.corepanel.net/install.sh | bash -s -- --yes

--yes answers the installer’s confirmation and setup questions for you, so the next step can set those values explicitly. Leave it out and the installer asks for them instead.

The installer takes 10 to 15 minutes. It installs CoreHttpd (CorePanel’s web server), PHP 8.4 and 7.4, MariaDB 10.11, Postfix, Dovecot, Rspamd, PowerDNS and Pure-FTPd, opens their ports in firewalld, and checks that every service is running before it reports success. If it ends with INSTALL FAILED, stop there: it names the service that is down and the command to read its log.

Name the panel

The panel domain is the address you open CorePanel at. Use a name under your own domain:

corepanel system init --domain panel.example.com --admin-email admin@example.com --no-interactive

The command prints the panel address and the password for the coreadmin user. It may also say that DNS is not yet pointing to this server: nothing publishes the panel’s address until the next step, so that is expected here. The password is also saved in /root/.corepanel_password, readable by root only:

test -s /root/.corepanel_password
corepanel status

corepanel status lists the four CorePanel services. Every one of them should be active and running.

Finish the setup in the panel

Open https://panel.example.com in your browser and sign in as coreadmin.

If the delegation from the first section has not spread yet, the name does not resolve. Open https://203.0.113.10 (your server’s IP) instead: the browser warns about a self-signed certificate, which is expected on that address. The wizard printed the certificate’s fingerprint, so you can check it before accepting.

The first sign-in asks two things.

The edition. Choose Personal to stay on the free edition. You can start a trial of Pro or Business from Server → License whenever you like.

The initial configuration, a four-step assistant:

1. Company — the name your customers see.
2. Server basics — the panel hostname and the main IP, already filled in.
3. Nameservers — ns1.example.com and ns2.example.com, each with the server’s IP. They must be exactly the names you registered at the registrar.
4. Review — check and click Finish.

When you click Finish, CorePanel publishes the panel’s address and the nameservers’ addresses in a DNS zone for example.com. From now on, your server answers DNS for the domain.

Create your first hosting account

A hosting account is one customer, or one site of yours: a Linux user, a home directory, a website, a database allowance, mailboxes and a DNS zone. In the panel, go to Accounts → Add account, enter example.com as the domain, generate a password and click Create.

The same from the shell:

ACCOUNT_PASSWORD="$(openssl rand -base64 24)Aa1!"
printf '%s' "$ACCOUNT_PASSWORD" | corepanel account create example.com --password-stdin --owner-email admin@example.com
corepanel account list

The password is read from standard input so it never shows up in your shell history or in the process list. Keep it: it is also the password of the account’s first FTP user.

CorePanel derived the Linux username, example, from the domain. Creating the account did several things at once:

• a Linux user that owns /home/example, with the website in public_html;
• a PHP-FPM pool running as that user, on the newest PHP installed;
• a virtual host for example.com and www.example.com;
• DNS records for the website and for mail, with an SPF record and a DKIM key;
• an order for a Let’s Encrypt certificate covering example.com and *.example.com.

Your server now answers for the domain the way the rest of the internet will ask it. Query it directly:

dig +short @127.0.0.1 NS example.com
dig +short @127.0.0.1 A www.example.com
dig +short @127.0.0.1 MX example.com
dig +short @127.0.0.1 TXT example.com

The answers are your two nameservers, the server’s IP, 10 mail.example.com. and the SPF record "v=spf1 a mx ~all".

Put something on the site

Upload your site over SFTP with the account’s username and password, or from the panel’s File manager. For this tutorial, a one-line PHP page is enough. Write it as the account’s user, so the file belongs to the site and not to root:

sudo -u example tee /home/example/public_html/index.php > /dev/null <<'EOF'
<?php echo "Hello from ", $_SERVER['HTTP_HOST'], " on PHP ", PHP_VERSION, "\n";
EOF

Check the certificate

Because the server is authoritative for example.com, CorePanel proves control of the domain with a DNS record (the DNS-01 challenge) and gets one wildcard certificate for example.com and *.example.com — usually within a minute or two of creating the account, before anybody visits. Wait for it:

timeout 300 bash -c 'until curl -fsS -o /dev/null https://www.example.com/ 2>/dev/null; do sleep 5; done'
curl -fsS https://www.example.com/

The first line retries for up to five minutes. The second must print the greeting from your PHP page, over HTTPS, with no certificate error.

Look at the certificate itself:

echo | openssl s_client -connect www.example.com:443 -servername www.example.com 2>/dev/null | openssl x509 -noout -ext subjectAltName > /tmp/san.txt
cat /tmp/san.txt
grep -F 'DNS:*.example.com' /tmp/san.txt

The certificate names *.example.com, so mail.example.com, webmail.example.com and ftp.example.com are covered by it too. CorePanel renews it in the background before it expires; there is no cron job or certbot timer for you to look after.

The panel has a certificate of its own. CoreHttpd obtained it for panel.example.com the first time the name was asked for over HTTPS, and renews it the same way:

curl -fsS -o /dev/null -w '%{http_code}\n' https://panel.example.com/

That prints 200, with no certificate warning.

One more detail: example.com and www.example.com both answer, but only one should be the real address, or search engines see two copies of the site. New domains use www, and the bare name redirects to it with a 301 that keeps the path:

curl -sS -o /dev/null -w '%{http_code} %{redirect_url}\n' https://example.com/about

That prints 301 https://www.example.com/about. To use the bare name instead, change the domain’s canonical host in the panel, or run corepanel domain canonical set example.com nonwww.

What you have now

Next steps

• Host a WordPress site with email, SSL and nightly backups
• Set up email so it reaches Gmail: SPF, DKIM, DMARC and reverse DNS
• Secure a new hosting server: WAF, firewall, brute-force protection and SSH