# SCpanel v1.3.7 — SSL Manager

## MUST delivered
- Let's Encrypt issue / renew / revoke / delete via Certbot.
- Automatic renewal twice daily through a persistent systemd timer.
- Certificate status and expiry countdown from the installed certificate.
- Force HTTPS with safe Nginx/Apache configuration test and reload.
- Admin and account-scoped User SSL Manager.
- Durable Task Center integration for certificate operations.
- Certbot deploy hook synchronizes renewed certificates into `/etc/scpanel/ssl/<domain>/` and reloads active web servers.
- Existing websites are migrated into the SSL certificate inventory without requiring a fresh install.

## Safety
- Issue/renew/revoke/delete actions are queued as durable tasks.
- Force HTTPS cannot be enabled without a valid managed certificate.
- Certificate private keys are stored with mode 0600.
- Domain/path values are validated before certificate store operations.

## Runtime note
The build environment validates source, templates, scripts and contracts. Real ACME issuance/renewal requires the target VM to have public DNS, port 80 reachability, a working Nginx/Apache site and Certbot installed.