How to Install a Free SSL Certificate on Your Website

You can install a free SSL certificate using Let's Encrypt, a no-cost certificate authority backed by Mozilla, Google, and the EFF. The process takes under 15 minutes and secures your site with the same HTTPS encryption as paid certificates.

This guide covers three paths: cPanel (the most common for shared hosting), Apache on a VPS or dedicated server, and Nginx. Pick the one that matches your environment.

What Is Let's Encrypt and Why Use It?

Let's Encrypt is a free, automated, and open certificate authority. Its DV (domain validation) certificates are trusted by every modern browser and deliver the same TLS 1.3 encryption as any paid SSL.

Key advantages:

• Zero cost, no credit card required.
• Automatic renewal every 90 days (once configured).
• Compatible with cPanel, Plesk, DirectAdmin, Apache, Nginx, and Caddy.
• Wildcard certificates available via ACME DNS-01 challenge.

The only real limitation is that it does not offer OV (organization validation) or EV (extended validation). For most websites — blogs, portfolios, landing pages, small businesses — this doesn't matter.

Before You Start: Prerequisites

Regardless of the method, you need:

• Ownership or admin access to the domain.
• The domain must point correctly to the server (active A or CNAME DNS records).
• Access to your hosting control panel or SSH access to the server.
• Ports 80 and 443 open in the server firewall.

If your domain hasn't finished propagating, wait before requesting the certificate. Let's Encrypt validates domain ownership by making a real HTTP request to your server.

Method 1: Install a Free SSL Certificate in cPanel (Shared Hosting)

Most hosting providers already include Let's Encrypt built into cPanel. This is the easiest method.

Step 1 — Open AutoSSL or SSL/TLS in cPanel

Log in to cPanel. Under the Security section, look for one of these options:

• SSL/TLS Status (cPanel with AutoSSL enabled)
• Let's Encrypt SSL (cPanel Let's Encrypt plugin)
• SSL/TLS → Install and Manage SSL

Step 2 — Select the Domain and Request the Certificate

Check your domain and subdomains (including www.yourdomain.com) and click Run AutoSSL or Issue Certificate. cPanel contacts Let's Encrypt, automatically completes the HTTP-01 challenge, and downloads the certificate.

Step 3 — Verify the Installation

Visit https://yourdomain.com. You should see a closed padlock in the browser's address bar. If you see mixed content warnings, read the section on forcing HTTPS below.

AutoSSL renews the certificate automatically before it expires — no action needed on your part.

Method 2: Install Let's Encrypt on Apache (VPS or Dedicated Server)

On a self-managed server running Ubuntu/Debian or RHEL/Rocky Linux, the official tool is Certbot.

Step 1 — Install Certbot

# Ubuntu / Debian
sudo apt update
sudo apt install certbot python3-certbot-apache -y

# RHEL / Rocky / AlmaLinux
sudo dnf install certbot python3-certbot-apache -y

Step 2 — Request and Download the Certificate

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot detects your Apache VirtualHost, requests the certificate from Let's Encrypt, installs it, and updates the VirtualHost to enable HTTPS — including the HTTP-to-HTTPS redirect if you confirm.

Step 3 — Confirm Automatic Renewal

sudo systemctl status certbot.timer
# or test renewal in dry-run mode:
sudo certbot renew --dry-run

On modern distributions, Certbot installs a systemd timer that renews certificates automatically. With no additional setup, your SSL will remain valid indefinitely.

Step 4 — Reload Apache

sudo systemctl reload apache2   # Debian/Ubuntu
sudo systemctl reload httpd     # RHEL/Rocky

Method 3: Install Let's Encrypt on Nginx

Step 1 — Install Certbot with the Nginx Plugin

# Ubuntu / Debian
sudo apt install certbot python3-certbot-nginx -y

Step 2 — Request the Certificate

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot edits your server block in Nginx, installs the certificates, and automatically configures the HTTPS redirect.

Step 3 — Verify and Reload Nginx

sudo nginx -t
sudo systemctl reload nginx

Method Comparison

Force HTTPS and Fix Mixed Content

Installing the certificate is not enough: you need to redirect all HTTP traffic to HTTPS and make sure no resource (images, scripts, CSS) loads over a plain http:// URL.

Redirect HTTP → HTTPS in Apache (.htaccess)

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirect HTTP → HTTPS in Nginx

server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

Detect Mixed Content

Open the browser DevTools (F12) → Console tab. Look for warnings labeled "Mixed Content". Each http:// URL you find must be updated to https:// in your code or CMS.

In WordPress, the Better Search Replace plugin lets you replace http://yourdomain.com with https://yourdomain.com across the entire database in one click.

If you need help with server security configuration or want to hand off the whole process, the team at elenlace.com can handle your SSL installation and maintenance.

Troubleshooting Common Issues

Error: "Too many certificates already issued"

Let's Encrypt limits you to 5 certificates per root domain every 7 days. If you've hit the cap, wait before trying again.

Challenge fails: "Could not connect to server"

Check that port 80 is open in the firewall, that the domain points to the correct IP, and that no redirect rule is blocking the /.well-known/acme-challenge/ path.

Certificate doesn't renew automatically

Verify that the Certbot timer is active (systemctl status certbot.timer). In cPanel, check under Cron Jobs that the AutoSSL process is scheduled.

For more resources on SSL security and certificates for websites, browse our full article library on the topic.

Key Takeaways

• Let's Encrypt provides free, valid, and browser-trusted SSL certificates for any website.
• In shared hosting with cPanel, AutoSSL installs and renews the certificate without manual intervention.
• On a VPS or dedicated server, Certbot (with the Apache or Nginx plugin) automates the entire process.
• Installing the certificate is just the first step: redirect HTTP to HTTPS and eliminate mixed content.
• Automatic renewal is critical — configure it from day one so your HTTPS never expires.
• Let's Encrypt issues DV certificates; if you need OV or EV, consider a paid SSL.

Ready to activate HTTPS on your site? If you'd rather have a specialist do it for you, reach out to the team at elenlace.com and we'll have your SSL live today.

FAQ

Is the free Let's Encrypt SSL certificate secure?

Yes. Let's Encrypt issues DV certificates with TLS 1.2/1.3 encryption — identical to paid certificates. The difference lies in the validation level, not the encryption strength. It is trusted by all modern browsers and by Google.

How long does the certificate last and does it renew automatically?

Let's Encrypt certificates are valid for 90 days. When you install Certbot or use AutoSSL in cPanel, renewal happens automatically — typically around the 60-day mark, well before expiry.

Can I use Let's Encrypt with any hosting provider?

Almost always. Most hosting providers already include Let's Encrypt integrated into cPanel, Plesk, or DirectAdmin. If your provider doesn't support it, you can install Certbot on a VPS or switch to a hosting plan that includes it.

Do I need a paid SSL certificate for an online store?

Not necessarily. For most e-commerce sites, a DV certificate from Let's Encrypt is sufficient to encrypt transactions. OV or EV certificates add more visual trust signals, but not stronger encryption. Evaluate your business profile before paying for one.

Further reading

Other providers and guides worth comparing:

• Hostinger
• HubSpot
• IONOS