When you launch a new web application or website on your VPS, it defaults to serving traffic over standard HTTP. This protocol transmits data in plain text, meaning anyone monitoring the network can easily intercept passwords, session cookies, and sensitive user data. Securing this communication channel with SSL/TLS encryption is no longer optional—modern browsers will actively flag your site as "Not Secure" if you fail to implement it.
Let's Encrypt is a free, automated, and open certificate authority. By pairing it with a software client called Certbot, you can provision highly secure SSL certificates for your domains in minutes, immediately encrypting all traffic between your server and your users.
Installing the Certbot Client
Certbot, developed by the Electronic Frontier Foundation, handles the entire process of requesting, verifying, and installing the certificates directly into your web server configuration.
-
Connect to your server via SSH as a user with sudo privileges.
-
Ensure your package manager is up to date by running
sudo apt update. -
If you are running the Nginx web server, install the client and its corresponding plugin by running
sudo apt install certbot python3-certbot-nginx. -
If you are using Apache, run
sudo apt install certbot python3-certbot-apacheinstead.
Generating and Installing the Certificate
Before requesting a certificate, you must ensure that your domain name's DNS A-records are properly pointing to your server's public IP address, and that your UFW firewall allows traffic on port 80 (HTTP) and port 443 (HTTPS).
-
Execute the Certbot wizard for Nginx by running
sudo certbot --nginx, or for Apache by runningsudo certbot --apache. -
The terminal will prompt you to enter an email address. This is strictly used by Let's Encrypt for urgent security notices and expiration warnings—it will not be made public.
-
Agree to the terms of service and specify which active domains (e.g.,
yourdomain.comand[www.yourdomain.com](https://www.yourdomain.com)) you want to secure. -
Certbot will automatically reach out to the Let's Encrypt servers, cryptographically verify that you control the domain, and modify your web server configuration files to apply the new certificates.
Enforcing HTTPS Redirection
Simply having an SSL certificate installed does not stop users from accidentally visiting the insecure HTTP version of your site. You must ensure that all plain-text traffic is actively forced onto the encrypted channel.
During the initial Certbot installation wizard, you will usually be asked if you want to redirect HTTP traffic to HTTPS. Always select Yes. If you bypassed this step, you must manually update your web server blocks.
For Nginx, ensure your port 80 server block contains a strict 301 redirect: return 301 https://$host$request_uri;
This guarantees that even if a user types http:// into their browser, the server instantly bounces them to the secure connection before any data is exchanged.
Automating Certificate Renewals
Let's Encrypt issues certificates that are valid for exactly 90 days. This short lifespan limits damage if a certificate is compromised, but it means manual renewal is highly impractical. Fortunately, the Certbot package automatically configures a background system timer to handle this for you.
-
Verify that the automated renewal timer is active and running by executing
sudo systemctl status certbot.timer. -
Run a dry-run test to guarantee that the renewal process will succeed when the time comes, without actually modifying your live certificates:
sudo certbot renew --dry-run -
If the dry run outputs no errors, your server is successfully configured to renew its certificates silently in the background before they ever expire.
