Start with the actual routing plan
Use your own domains and assigned addresses. Review the current installed listeners and allowed network exposure before publishing DNS or changing a firewall. The initial panel listener is loopback; customer website health can also refer only to its local path.
For a local authoritative zone, verify its owning account, intended records, nameservers and any required registrar glue. Confirm both UDP and TCP DNS reachability from an independent network. Two nameserver labels on the same machine do not provide a second failure domain.
For external DNS, follow the reported external requirements. A panel record or local resolver result does not establish that the parent delegation is correct.
Configure HTTPS through the supported flow
The SSL workflow separates owned names, ACME challenge eligibility, contact/terms, routing preflight, staging and production. Production issuance requires the actual staging prerequisite. Wildcards require the supported DNS-01 path.
Imported certificates and private keys remain sensitive; never include them in screenshots or support reports. A local bootstrap certificate is not a publicly trusted certificate for your website.
Verify independently
Test the exact hostname, expected certificate, IPv4/IPv6 paths and application content from outside the server after the supported public-routing procedure. Missing DNS, firewall, CA or listener acceptance remains unresolved even if a page in the panel shows a submitted request.