Free SSL on VPS with Let's Encrypt & Certbot (2024)

Q: Can I use the same certificate for multiple domains?

Yes. Certbot accepts multiple domains using the -d flag. A single certificate can cover up to 100 domain names (SAN). You can also use wildcard certificates (*.yourdomain.com) via the DNS-01 challenge instead of HTTP-01.

To configure SSL on a VPS, install Certbot, run certbot --nginx or certbot --apache depending on your web server, and Let's Encrypt will issue and configure a free HTTPS certificate in under five minutes. Auto-renewal is set up automatically.

This guide covers the complete process: prerequisites, Certbot installation, certificate issuance, verification, and automatic renewal. By the end, you'll have HTTPS active on your domain at zero certificate cost.

Prerequisites

Before running Certbot, make sure the following are in place:

Domain pointing to your VPS. The A record (and AAAA for IPv6) must point to your server's public IP. Let's Encrypt verifies this during issuance.
Port 80 open. Certbot uses the HTTP-01 challenge by default, which requires port 80 to be reachable from the internet.
Web server running. Nginx or Apache must be installed and serving the domain.
Root or sudo access. Certbot needs to write to system directories.

Verify the domain resolves correctly before proceeding:

dig +short yourdomain.com

The output should be your VPS's public IP address.

Step 1 — Install Certbot

The recommended installation method is Snap, the official approach from the Electronic Frontier Foundation (EFF). Snap is available on Ubuntu by default; on other distributions you may need to install it first.

Install via Snap (recommended)

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Install via apt (Ubuntu/Debian alternative)

sudo apt update
sudo apt install certbot python3-certbot-nginx -y
# or for Apache:
sudo apt install certbot python3-certbot-apache -y

Install via dnf (AlmaLinux/Rocky Linux)

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -y

Confirm the installation:

certbot --version

Step 2 — Obtain the SSL Certificate

Certbot automatically detects the server blocks (virtual hosts) in your web server config and modifies them to enable HTTPS.

With Nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

With Apache

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot will ask you for:

Your email address (for expiry notices and urgent alerts).
Agreement to the terms of service.
Whether you'd like to receive EFF emails (optional).
Whether to redirect all HTTP traffic to HTTPS — choose yes.

When finished, you'll see a success message with the path where certificates were saved (typically /etc/letsencrypt/live/yourdomain.com/).

If you're looking for a professional web hosting and security agency to handle this setup for you, the elenlace.com team can take care of the entire process.

Step 3 — Verify HTTPS Is Working

Open your browser and go to https://yourdomain.com. You should see the padlock in the address bar. You can also check from the terminal:

curl -I https://yourdomain.com

Look for the HTTP/2 200 (or HTTP/1.1 200 OK) line. If you see a certificate error, check:

That DNS has propagated correctly (dig +short yourdomain.com).
That port 443 is open in your firewall.
Certbot logs at /var/log/letsencrypt/letsencrypt.log.

For a thorough check, run the SSL Labs test at ssllabs.com/ssltest/ — you should get an A or A+ rating.

Step 4 — Automatic Renewal

Let's Encrypt certificates expire every 90 days. Certbot installs a systemd timer (or cron job) that attempts to renew all certificates twice daily.

Check that the timer is active:

sudo systemctl status snap.certbot.renew.timer
# or if installed via apt:
sudo systemctl status certbot.timer

Test the renewal process without actually issuing a certificate:

sudo certbot renew --dry-run

If the dry run completes without errors, automatic renewal is working correctly. You don't need to do anything else.

Situation	Action
Dry run succeeds	Do nothing; renewal is automatic.
Dry run fails (port 80 blocked)	Open port 80 in firewall during renewal windows.
Domain changes IP	Update DNS before the next renewal attempt.
Certificate already expired	Run `sudo certbot renew --force-renewal`.

Find more infrastructure setup guides in our VPS servers section.

Step 5 — Harden Your TLS Configuration (Optional but Recommended)

Certbot sets up TLS with reasonable defaults, but you can improve your security rating by disabling outdated protocols.

In Nginx

Edit your server block and ensure you have:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

In Apache

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256
Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains"

The HSTS header (Strict-Transport-Security) tells browsers to always use HTTPS for your domain, even if the user types http://. It's an effective defense against protocol downgrade attacks.

Want your web project to have best-in-class security configuration from day one? elenlace.com offers professional server setup and managed hosting services.

Key Takeaways

Let's Encrypt issues free SSL certificates valid for 90 days; Certbot renews them automatically.
Install Certbot via Snap for the most up-to-date version.
A single command (certbot --nginx or certbot --apache) sets up HTTPS and redirects HTTP traffic.
Run certbot renew --dry-run after install to confirm auto-renewal is working.
Add HSTS and disable TLS 1.0/1.1 to achieve an A+ rating on SSL Labs.

With these steps, your VPS serves encrypted content reliably at no certificate cost. For managed hosting with SSL already configured out of the box, visit elenlace.com and explore our plans.

FAQ

Are Let's Encrypt certificates safe for e-commerce sites?

Yes. Let's Encrypt issues Domain Validated (DV) certificates with the same encryption strength as paid certificates. The difference between DV, OV, and EV certificates is the level of business identity verification, not encryption security. For most e-commerce use cases, DV is sufficient.

What happens if the certificate expires before it renews?

Browsers will display a security warning and block access to the site. To avoid this, ensure the renewal timer is active and port 80 is open. Let's Encrypt also sends warning emails 20 and 10 days before expiry.

Can I use the same certificate for multiple domains?

Yes. Certbot accepts multiple domains using the -d flag. A single certificate can cover up to 100 domain names (SAN). You can also use wildcard certificates (*.yourdomain.com) via the DNS-01 challenge instead of HTTP-01.

Does Certbot work with any web server?

Certbot has native plugins for Nginx and Apache. For other servers (Caddy, HAProxy, etc.), use certonly --standalone or certonly --webroot mode to obtain the certificate, then configure the server manually.

Compare providers

Other providers and guides worth comparing: