Quick answer: Use Let's Encrypt with certbot: point your domain at the server, install certbot, and run certbot --nginx or certbot --apache. The certificate is issued in seconds, is trusted by all browsers, costs nothing and renews automatically.
Overview
Let's Encrypt issues domain-validated certificates through the ACME protocol. Certbot proves to the CA that you control the domain (via a temporary HTTP challenge or DNS record), fetches the certificate and — with the web-server plugins — edits your nginx/apache config for you. Control panels have this built in (panel instructions).
Before you start
- DNS already pointing at this server (how) — issuance fails otherwise.
- Ports 80 and 443 open in the firewall.
- Root/sudo SSH access to the VPS.
Step-by-step guide
- Install certbot (Ubuntu/Debian shown; snap is the vendor-recommended channel):
sudo apt update
sudo apt install -y snapd
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot- Issue and auto-configure for your web server:
sudo certbot --nginx -d example.com -d www.example.com
# or: sudo certbot --apache -d example.com -d www.example.com
# no web server yet: sudo certbot certonly --standalone -d example.com- Answer the prompts (email for expiry notices, redirect choice).
- Verify in a browser — the padlock should be clean — and test renewal:
sudo certbot renew --dry-runCommon issues
- Challenge failed: DNS not pointing here yet, or port 80 closed — check
dig +short A example.comandufw status. - Rate limits: repeated failed attempts hit Let's Encrypt limits; fix the cause before retrying many times.
- Mixed content after enabling HTTPS: the padlock shows a warning — see fixing mixed content.
When to contact support
If issuance fails even though DNS resolves to your server and ports are open, open a ticket with the certbot error output — we will check nothing on the network path is interfering.
Frequently asked questions
Is a Let's Encrypt certificate as good as a paid one?
For encryption and browser trust — yes, identical padlock and TLS strength. Paid certificates mainly add organization validation and warranty, which most sites do not need.
Why does certbot fail to issue my certificate?
The usual causes: the domain does not resolve to this server yet, port 80 is closed in the firewall, or another service occupies it. Fix reachability and run certbot again.
Does one certificate cover www and the bare domain?
Only if you request both names, e.g. certbot -d example.com -d www.example.com. Each hostname you serve must be listed in the certificate or browsers warn on it.
Related articles
- How to renew a Let's Encrypt SSL certificate
- How to redirect HTTP to HTTPS
- How to configure SSL for WordPress
- How to issue an SSL certificate (control panels)
Ready to get started? Order a VPS at Cloud2Y →
