SSL Certificate Setup: HTTPS with Let's Encrypt

An SSL certificate encrypts the traffic between a visitor and your server and gives you the padlock in the address bar. HTTPS is no longer optional: Google treats it as a lightweight ranking signal, modern browsers flag unencrypted forms as "Not secure", and it is mandatory for any site with a contact form, a login screen or a checkout step. The good news is that with Let's Encrypt you can install a valid certificate for free in a handful of commands. In this guide I walk through the full setup with Certbot on a Linux VPS for Nginx or Apache, plus automatic renewal and a safe HTTP-to-HTTPS redirect.

SSL, TLS and HTTPS: the difference

Let's clear up the terminology, because it is often mixed up. TLS (Transport Layer Security) is the current protocol that encrypts the traffic; SSL is its old name, yet everyone still says "SSL certificate". HTTPS is simply HTTP running over that TLS layer. The file you install on your server is technically a TLS certificate, but in practice we are all talking about the same thing.

Let's Encrypt issues Domain Validation (DV) certificates: they prove that you control the domain, not your company's legal identity. For most blogs, business sites and apps that is more than enough — the padlock and the encryption are identical to those of paid certificates. The one notable difference is that the certificate is valid for 90 days, which is why automatic renewal is the heart of the process.

What you need before you start

• A domain name with an A (or AAAA) DNS record pointing to your server's IP.
• SSH access to the server with sudo privileges.
• A running web server: Nginx or Apache.
• Ports 80 and 443 open in the firewall — Let's Encrypt validates over port 80.

Before you start, confirm the DNS record has propagated with dig +short yourdomain.com and check that it returns the right IP. A misconfigured record is the number-one reason validation fails.

Installing Certbot

Certbot is Let's Encrypt's official client and it automates obtaining the certificate, editing the config and renewing it. The recommended path is the snap package, because it always pulls the latest version. On Ubuntu/Debian:

sudo apt update
sudo apt install snapd -y
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

If you would rather not use snap, you can install it from the distribution repo with sudo apt install certbot python3-certbot-nginx (or python3-certbot-apache for Apache); the version may be slightly older but it works.

Getting a certificate for Nginx

The easiest approach is the Certbot Nginx plugin. A single command both obtains the certificate and adds the HTTPS block to your config automatically:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot asks for an email address (for renewal notices) and to accept the terms of service. It then asks whether to redirect HTTP requests to HTTPS automatically — choose the "Redirect" option. When it finishes, your server block looks similar to this:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate     /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

    # ... the rest of your application's config
}

Certbot also adds a second block listening on port 80 that redirects all traffic to https://. To apply the change, test and reload with sudo nginx -t && sudo systemctl reload nginx.

If you use Apache

The logic on the Apache side is the same; only the plugin changes:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot enables the mod_ssl and mod_rewrite modules, creates an SSL virtual host file and adds the redirect rule. If you prefer to obtain the certificate only, rather than letting Certbot edit the web server, on either server run sudo certbot certonly --webroot -w /var/www/yourdomain -d yourdomain.com and wire the config in by hand.

Automatic renewal: the most critical step

Because Let's Encrypt certificates last 90 days, forgetting to renew is the most common way to find your site unreachable one morning. Fortunately, a snap or package install of Certbot sets up an automatic systemd timer (or cron job) that runs twice a day and renews when the certificate enters its final 30 days. To confirm the timer is active:

systemctl list-timers | grep certbot

To verify renewal will work smoothly without actually renewing, run a dry run:

sudo certbot renew --dry-run

If that command completes without errors, automatic renewal is safe and you never have to think about it again. After a renewal the web server must load the new certificate; the Nginx/Apache plugins handle that for you, but if you installed by hand with certonly, remember to add --deploy-hook "systemctl reload nginx".

After setup: harden your HTTPS

The certificate works, but a few extra settings strengthen both security and SEO:

• HSTS header: the Strict-Transport-Security header tells browsers to open the site over HTTPS only. Start with a short duration and raise it once you are confident the setup is permanent.
• Mixed content: make sure every image, script and stylesheet link on the page uses https:// or is protocol-relative (//); otherwise the padlock breaks.
• Verify the redirect: curl -I http://yourdomain.com should return a 301 pointing to the HTTPS address.
• SSL Labs test: scan your configuration with the free SSL Labs Server Test and aim for at least an "A" grade.

Frequently Asked Questions

Is a Let's Encrypt certificate really free and secure?

Yes. Let's Encrypt is a non-profit certificate authority trusted by the major browsers and operating systems. The encryption strength is identical to paid DV certificates; the only difference is the 90-day validity and the need for automatic renewal.

I can't use Certbot on shared hosting — what now?

Many shared-hosting panels (cPanel, Plesk, DirectAdmin) already offer a built-in "AutoSSL" or one-click Let's Encrypt feature. In that case you never touch the command line: just select your domain in the panel and enable SSL.

Can I get a wildcard certificate?

Yes. A wildcard such as *.yourdomain.com requires DNS-01 validation: sudo certbot certonly --manual --preferred-challenges dns -d "*.yourdomain.com". If your DNS provider's API is supported, you can automate that validation too.

Want to move your site to secure HTTPS? If you need help with server configuration, certificate automation or performance, get in touch — I can handle the whole setup for you, end to end.