How to configure SSL certificates

Quick answer: Install certbot and request a free Let's Encrypt certificate: certbot --nginx or certbot --apache configures the web server for you; certbot certonly --webroot or --standalone just fetches the files. Renewal is automatic via a systemd timer — verify it with certbot renew --dry-run.

Overview

TLS is mandatory hygiene: browsers flag plain HTTP, search ranks HTTPS higher, and credentials must never cross the wire unencrypted. Let's Encrypt certificates are free, automated and renew every 60–90 days. Control panels have their own one-click Let's Encrypt flows (issue an SSL certificate in a panel); this guide covers the plain-VPS path.

Before you start

• A domain with an A/AAAA record pointing at your server — issuance validates over DNS-resolved HTTP.
• Ports 80/443 open in the firewall.
• Root/sudo access.

Step-by-step guide

1. Install certbot:

   apt install certbot python3-certbot-nginx -y     # Ubuntu/Debian + Nginx
   dnf install certbot python3-certbot-nginx -y     # Alma/Rocky (EPEL)

2. Request and auto-configure:

   certbot --nginx -d example.com -d www.example.com

   (Use python3-certbot-apache and --apache for Apache.)
3. No web server yet? Standalone mode binds port 80 itself:

   certbot certonly --standalone -d example.com

4. Verify auto-renewal:

   systemctl list-timers | grep certbot
   certbot renew --dry-run

5. Redirect HTTP to HTTPS when prompted, or add the redirect in your server block.

Common issues

• Challenge fails: DNS not pointing here yet, port 80 blocked, or another service already on port 80 (stop it for standalone mode).
• Mixed content after enabling HTTPS: assets still load over http:// — fix URLs; for WordPress see SSL for WordPress.
• Rate limits: Let's Encrypt limits issuance per domain per week — use --dry-run while testing.

When to contact support

Certificates and web server config are customer-managed. Open a ticket if validation fails because of network-level blocks you cannot explain after checking DNS and the firewall.

Frequently asked questions

Are Let's Encrypt certificates really free and safe?

Yes. They provide the same TLS encryption as paid certificates, are trusted by all modern browsers and renew automatically — the vast majority of websites use exactly this setup.

How does certificate renewal work?

Certbot installs a systemd timer that checks twice a day and renews any certificate within 30 days of expiry. Verify it once with certbot renew --dry-run and then forget about it.

Why did my certificate issuance fail?

The usual causes: the domain does not point at this server yet, port 80 is closed in the firewall, or another process occupies it while using standalone mode. Fix those and retry.

Related articles

• How to issue an SSL certificate
• How to configure SSL for WordPress
• How to configure a firewall
• How to protect an API or web app

Need a hand? Contact Cloud2Y support →