Install free SSL on VPS with Let's Encrypt (2025)

To install SSL on a VPS server for free, the most widely used solution is Let's Encrypt combined with Certbot: in under 10 minutes you get a valid certificate recognized by all browsers, with automatic renewal every 90 days.

What Is Let's Encrypt and Why Use It?

Let's Encrypt is a non-profit certificate authority (CA) that issues free SSL/TLS certificates in an automated fashion. It is the de facto standard for securing websites at no cost, backed by Mozilla, Google, Cisco, and the Electronic Frontier Foundation.

The main advantages over a paid certificate for a personal or agency VPS are:

Free: no cost, valid in all modern browsers.
Automatable: Certbot can renew it without manual intervention.
Wildcard available: cover *.yourdomain.com with a single certificate.
Widely supported: works with Nginx, Apache, HAProxy, and more.

For e-commerce sites with payment processing or extended validation (EV) requirements, a paid certificate may be warranted. For most VPS-hosted web applications, Let's Encrypt is more than sufficient.

Prerequisites Before You Start

Before running any command, confirm you meet these requirements:

Your domain points to your VPS IP address (DNS propagated). Check with dig yourdomain.com.
Port 80 (HTTP) is open in your firewall — Let's Encrypt needs it for the validation challenge.
You have root or sudo access to the server.
Nginx or Apache is installed and running correctly.

Installing Certbot on Your VPS

Certbot is the official Let's Encrypt client. Installation commands vary by Linux distribution.

On Ubuntu / Debian

sudo apt update
sudo apt install -y certbot python3-certbot-nginx
# or for Apache:
sudo apt install -y certbot python3-certbot-apache

On AlmaLinux / Rocky Linux / CentOS Stream

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx
# or for Apache:
sudo dnf install -y certbot python3-certbot-apache

Once installed, verify the version:

certbot --version

Obtaining and Installing the SSL Certificate

With Certbot installed, obtaining and installing the certificate is a single command. Certbot will automatically modify your web server configuration to enable HTTPS.

With Nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

With Apache

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot will ask two questions:

Your email address (for expiration alerts).
Whether to redirect HTTP to HTTPS automatically — choose Yes (option 2).

When finished, you will see a success message with the path where certificates were saved, typically /etc/letsencrypt/live/yourdomain.com/.

Wildcard Certificate (Covering All Subdomains)

To cover all subdomains, you need the DNS validation method:

sudo certbot certonly --manual --preferred-challenges dns \
  -d "*.yourdomain.com" -d yourdomain.com

Certbot will ask you to add a TXT DNS record to prove domain ownership.

Configuring Automatic Renewal

Let's Encrypt certificates expire after 90 days. Certbot automatically installs a systemd timer (or cron job) that attempts to renew certificates before they expire.

Verify the timer is active:

sudo systemctl status certbot.timer

Test renewal without actually executing it:

sudo certbot renew --dry-run

If the dry-run completes without errors, automatic renewal is correctly configured. The timer runs twice daily; if the certificate has more than 30 days of validity remaining, it does nothing.

Reloading Nginx or Apache After Renewal

Add a post-renewal hook so the web server reloads its configuration when the certificate is renewed:

# For Nginx
echo "#!/bin/bash
systemctl reload nginx" | sudo tee /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-nginx.sh

# For Apache
echo "#!/bin/bash
systemctl reload apache2" | sudo tee /etc/letsencrypt/renewal-hooks/post/reload-apache.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/post/reload-apache.sh

Verifying That SSL Is Working Correctly

Once the certificate is installed, verify everything is working:

Open https://yourdomain.com in your browser — you should see the padlock icon.
Use SSL Labs to get a detailed rating of your SSL configuration.
Verify the HTTP→HTTPS redirect by visiting http://yourdomain.com.

Check	Tool	Expected result
Valid certificate	Web browser	Padlock icon, no warnings
SSL rating	SSL Labs	A or A+
HTTP redirect	curl -I http://yourdomain.com	301 → https://
Auto-renewal	certbot renew --dry-run	No errors

If you need help setting up your VPS correctly from scratch, elenlace.com offers VPS server management and configuration services.

For more VPS management guides, visit our VPS resource center.

Key Takeaways

Let's Encrypt + Certbot install a free, browser-trusted SSL certificate in under 10 minutes.
The essential requirement is that the domain's DNS points to the VPS IP before running Certbot.
With --nginx or --apache, Certbot modifies the web server configuration automatically.
Automatic renewal is configured out of the box; verify with certbot renew --dry-run.
Add a post-renewal hook so Nginx or Apache reloads its configuration after each renewal.

Want someone to manage your VPS for you? The team at elenlace.com can handle SSL installation, server configuration, and monthly maintenance.

FAQ

Does Let's Encrypt work with any VPS?

Yes, as long as you have root access to the server and the domain points to the VPS IP. It works with Ubuntu, Debian, AlmaLinux, Rocky Linux, CentOS Stream, and practically any Linux distribution that supports Certbot.

How long does a Let's Encrypt certificate last?

90 days. However, Certbot sets up automatic renewal that will attempt to renew the certificate when it has fewer than 30 days of validity remaining. If correctly configured, you will never see an expired certificate.

Can I use Let's Encrypt with multiple domains on the same VPS?

Yes. You can have separate certificates for each domain, or a single SAN (Subject Alternative Names) certificate covering multiple domains. Certbot handles both cases without issue.

What if port 80 is blocked on my VPS?

The standard HTTP-01 validation method requires port 80. If it is blocked, use the DNS-01 method with the --preferred-challenges dns flag, which validates domain ownership through a DNS TXT record — no port 80 needed.

Useful resources

Other providers and guides worth comparing: