Configuring SSL on a VPS Using Certbot

Introduction

Certbot is a popular tool for issuing and renewing free Let’s Encrypt SSL certificates on Linux servers. It can configure HTTPS for websites running on Apache or Nginx and can also help set up automatic certificate renewal.

Before using Certbot, the domain must point to your VPS, the web server must respond correctly, and ports 80 and 443 must be reachable. If DNS, firewall, virtual hosts or web server configuration are wrong, certificate issuance may fail.

Quick answer

Configuring SSL on a VPS using Certbot

Configuring SSL on a VPS using Certbot means installing a trusted TLS certificate for your domain and configuring the web server to serve the site over HTTPS.

Certbot can:

• request Let’s Encrypt certificates
• validate domain ownership
• configure Apache SSL
• configure Nginx SSL
• renew certificates automatically
• install certificates for multiple hostnames
• redirect HTTP to HTTPS
• test renewal configuration

Before using Certbot

Before running Certbot, confirm the VPS and domain are ready.

Check:

• domain points to the VPS IP
• www record points correctly if used
• web server is installed
• website virtual host/server block exists
• port 80 is open
• port 443 is open
• firewall allows HTTP and HTTPS
• no CDN/proxy is blocking validation
• root domain and www are both planned
• email address is available for certificate notices

DNS requirements

For normal HTTP validation, the domain must resolve to the VPS where Certbot is running.

Common records:

• example.com A record → VPS IPv4 address
• www.example.com CNAME → example.com
• AAAA record only if IPv6 is configured correctly
• no old A/AAAA records pointing to another server

Firewall requirements

Certbot HTTP validation usually requires port 80 to be reachable. HTTPS requires port 443.

Common ports:

• 80/tcp for HTTP validation and redirects
• 443/tcp for HTTPS traffic

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

Install Certbot

Install Certbot and the correct plugin for your web server.

sudo apt update
sudo apt install certbot python3-certbot-apache -y

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

certbot --version

Using Certbot with Apache

For Apache, Certbot can detect virtual hosts and update SSL configuration.

sudo certbot --apache -d example.com -d www.example.com

sudo apache2ctl configtest
sudo systemctl reload apache2

Using Certbot with Nginx

For Nginx, Certbot can detect server blocks and add SSL configuration.

sudo certbot --nginx -d example.com -d www.example.com

sudo nginx -t
sudo systemctl reload nginx

Standalone mode

Standalone mode can be used when Certbot temporarily runs its own validation server.

# Stop web server first if needed:
sudo systemctl stop nginx

# Run Certbot standalone:
sudo certbot certonly --standalone -d example.com -d www.example.com

# Start web server again:
sudo systemctl start nginx

HTTP to HTTPS redirects

After SSL is installed, visitors should be redirected from HTTP to HTTPS.

http://example.com
→ 301
https://example.com

Also check:

• www to non-www or non-www to www
• no redirect loops
• no long redirect chains
• canonical URL is consistent
• application URLs use HTTPS

Automatic renewal

Let’s Encrypt certificates are short-lived, so renewal must work automatically.

sudo certbot renew --dry-run

systemctl list-timers | grep certbot
sudo certbot certificates

Why this matters

On a VPS, SSL problems often come from DNS, firewall, web server config, wrong hostnames or failed renewal—not from Certbot itself.

How to check Certbot SSL setup

Use SSL Checker, Website Status Checker and command-line checks after installation.

1. DNS — Confirm domain points to the VPS.
2. Web server — Confirm Apache or Nginx serves the correct domain.
3. Firewall — Confirm ports 80 and 443 are reachable.
4. Certificate coverage — Check root domain and www if both are used.
5. HTTPS response — Confirm the site loads over HTTPS.
6. Redirects — Check HTTP to HTTPS and www/non-www behavior.
7. Renewal — Run Certbot dry-run renewal test.
8. Mixed content — Check whether page assets still load over HTTP.

Common problems

How to configure SSL with Certbot safely

1. Step 1: Confirm DNS points to VPS

   Check A, AAAA and CNAME records before running Certbot.

2. Step 2: Open firewall ports

   Allow HTTP and HTTPS traffic.

3. Step 3: Check web server config

   Confirm Apache virtual host or Nginx server block matches the domain.

4. Step 4: Install Certbot

   Install Certbot and the correct Apache or Nginx plugin.

5. Step 5: Issue certificate

   Run Certbot for the root domain and www if needed.

6. Step 6: Enable HTTPS redirects

   Redirect HTTP to HTTPS and choose one canonical hostname.

7. Step 7: Test the certificate

   Use SSL Checker and browser tests.

8. Step 8: Test renewal

   Run certbot renew --dry-run.

9. Step 9: Check application URLs

   Fix mixed content and update CMS/site URLs if needed.

10. Step 10: Monitor expiry

    Monitor certificate expiration and renewal status.

Useful Certbot commands

Check Certbot version:
certbot --version

List certificates:
sudo certbot certificates

Issue Apache certificate:
sudo certbot --apache -d example.com -d www.example.com

Issue Nginx certificate:
sudo certbot --nginx -d example.com -d www.example.com

Renew certificates:
sudo certbot renew

Dry-run renewal:
sudo certbot renew --dry-run

Delete certificate:
sudo certbot delete

Check Apache config:
sudo apache2ctl configtest

Check Nginx config:
sudo nginx -t

Reload Apache:
sudo systemctl reload apache2

Reload Nginx:
sudo systemctl reload nginx

Nginx SSL example

Certbot can automatically edit Nginx config, but a simplified HTTPS server block may look like this:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://example.com$request_uri;
}

server {
    listen 443 ssl http2;
    server_name example.com;

    root /var/www/example.com/public_html;
    index index.html index.php;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        try_files $uri $uri/ =404;
    }
}

Apache SSL example

Certbot can automatically create Apache SSL configuration, but a simplified virtual host may look like this:

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>

<VirtualHost *:443>
    ServerName example.com
    DocumentRoot /var/www/example.com/public_html

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
</VirtualHost>

Certbot with CDN or proxy

If your domain uses a CDN or proxy, Certbot validation may behave differently.

Check:

• CDN points to the VPS
• HTTP validation path reaches origin
• proxy SSL mode is compatible
• CDN does not block /.well-known/acme-challenge/
• origin certificate is valid if using full strict mode
• DNS-only mode may be needed during issuance
• CDN cache should not interfere with validation

Renewal monitoring

Certbot usually installs a timer or cron job for renewal, but you should still monitor it.

Monitor:

• certificate expiry date
• certbot renewal logs
• web server reload after renewal
• failed renewal emails
• DNS changes that affect validation
• firewall changes
• CDN/proxy changes
• domain names added or removed

Frequently asked questions