How to Install an SSL Certificate on Your VPS

Q: Do I need to restart Apache or Nginx after installing the certificate?

Certbot does it automatically when using the --apache or --nginx plugins. If you install the certificate manually, you do need to reload the server (systemctl reload apache2 or systemctl reload nginx) for the change to take effect.

To install SSL on a Linux VPS, the fastest and completely free method is using Let's Encrypt with the Certbot tool, which obtains, installs, and auto-renews your certificate in under five minutes.

This guide walks you through the entire process: preparing the server, installing Certbot, obtaining the certificate, and configuring automatic renewal. Examples cover both Apache and Nginx on Ubuntu/Debian and AlmaLinux/Rocky Linux.

Why Does Your VPS Need SSL?

An SSL certificate encrypts communication between your server and visitors, converting URLs from http:// to https://. The reasons to install it go beyond security:

SEO: Google favors HTTPS sites in search rankings.
User trust: the padlock icon builds credibility, especially on stores or forms.
Required for modern APIs: many APIs and payment services reject unencrypted connections.
Compliance: GDPR, PCI-DSS, and other data regulations require encryption in transit.

Before You Start: Prerequisites

Before running Certbot, make sure you meet these requirements:

Your domain already points to your VPS IP (A or AAAA record in your DNS).
The web server (Apache or Nginx) is installed and running.
Ports 80 and 443 are open in your firewall.
You have root or sudo access to the server.

Verify your domain resolves correctly before proceeding:

dig +short yourdomain.com

It should return your VPS IP. If it doesn't, wait for DNS propagation before continuing — Certbot will fail if the domain doesn't resolve to your server.

Step 1: Install Certbot

Certbot is the official Let's Encrypt tool for obtaining and managing free SSL certificates.

On Ubuntu or Debian

sudo apt update
sudo apt install certbot python3-certbot-apache   # for Apache
# or
sudo apt install certbot python3-certbot-nginx    # for Nginx

On AlmaLinux, Rocky Linux, or CentOS

sudo dnf install epel-release
sudo dnf install certbot python3-certbot-apache   # for Apache
# or
sudo dnf install certbot python3-certbot-nginx    # for Nginx

Certbot is also available as a snap on supported systems:

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Step 2: Obtain and Install the SSL Certificate

Once Certbot is installed, obtaining the certificate is a single command. Certbot connects to Let's Encrypt's servers, verifies you control the domain (via HTTP), and automatically installs the certificate.

With Apache

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

With Nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot will ask two questions:

Your email address (for expiration notices).
Whether you want to automatically redirect all HTTP traffic to HTTPS — choose yes (option 2).

When done, your site will already be serving HTTPS. Verify it with:

curl -I https://yourdomain.com

Look for HTTP/2 200 in the response.

Step 3: Verify the SSL Configuration

Certbot automatically modifies the web server configuration. It's worth checking everything is correct:

Test with SSL Labs

Visit ssllabs.com/ssltest and enter your domain. A properly configured Let's Encrypt certificate should score A or A+.

Check Apache config

sudo apache2ctl configtest   # Debian/Ubuntu
sudo apachectl configtest    # RHEL

Check Nginx config

sudo nginx -t

If there are errors, review the virtual host files Certbot modified (usually in /etc/apache2/sites-enabled/ or /etc/nginx/sites-enabled/).

Step 4: Set Up Automatic Renewal

Let's Encrypt certificates are valid for 90 days. Certbot includes a systemd timer (or cron job) that automatically renews certificates before they expire.

Verify the timer is active:

sudo systemctl status certbot.timer   # Debian/Ubuntu
sudo systemctl status certbot-renew.timer   # RHEL

Test the renewal process without making real changes:

sudo certbot renew --dry-run

If the dry-run completes without errors, automatic renewal will work correctly. Let's Encrypt renews the certificate when fewer than 30 days of validity remain.

Aspect	Let's Encrypt (Certbot)	Commercial certificate
Cost	Free	$10–$300+ USD/year
Validity	90 days (auto-renewable)	1–2 years
Validation type	DV (domain)	DV, OV, or EV
Wildcard	Yes (with DNS challenge)	Yes
Financial warranty	No	Yes (varies)

For most websites, blogs, online stores, and applications, Let's Encrypt is more than enough. A commercial EV certificate is only justified if your brand needs to display the company name in the browser bar.

If you manage multiple domains on your VPS, our VPS server guides cover LAMP stack setup, Nginx configuration, and multi-site management in detail.

Key takeaways

Let's Encrypt and Certbot let you install SSL on your VPS for free in minutes.
Before running Certbot, verify the domain resolves to your server's IP.
Use the native plugin (--apache or --nginx) so Certbot configures the web server automatically.
Let's Encrypt certificates last 90 days but renew automatically via a systemd timer.
Run certbot renew --dry-run to confirm automatic renewal is working.
For wildcard certificates or many subdomains, use the DNS challenge (--dns-...).

Need help setting up HTTPS on your VPS or managing multiple domains? The team at elenlace.com provides specialized technical support to get your infrastructure secure and ready from day one.

FAQ

Is Let's Encrypt as secure as a paid certificate?

Yes. The encryption level is identical. The difference between a free DV certificate and a commercial DV certificate is only price and duration. OV and EV certificates offer additional organization validation, but not stronger encryption.

What happens if Certbot can't renew the certificate?

Let's Encrypt sends email warnings when 20 and 7 days remain before expiration. If the dry-run fails, check that port 80 is open and the domain still resolves to your server. In the meantime, the site will continue working with the existing certificate until it expires.

Can I use one SSL certificate for multiple subdomains?

Yes. You can include multiple domains and subdomains in the same Certbot command using multiple -d flags. For a wildcard covering all subdomains of a domain (e.g. *.yourdomain.com), you need to use the DNS challenge instead of the HTTP challenge.

Do I need to restart Apache or Nginx after installing the certificate?

Certbot does it automatically when using the --apache or --nginx plugins. If you install the certificate manually, you do need to reload the server (systemctl reload apache2 or systemctl reload nginx) for the change to take effect.

Prefer it done for you? El Enlace handles hosting and professional web development.