Free SSL certificates on your VPS with Let's Encrypt

There's no reason to run a site on plain HTTP anymore. SSL/TLS certificates are free, thanks to Let's Encrypt, and issuing one on a VPS takes a couple of minutes. Do it right and it renews itself forever, so you never see that dreaded full-page "your connection is not secure" warning. On a Nxeon VPS you have the full root access needed to set this up exactly how you want — or to let a one-click control panel handle it for you. Here's the complete guide.

Why HTTPS is non-negotiable

• Trust. Browsers mark plain HTTP sites as "Not Secure." Visitors bounce; conversions drop.
• Security. HTTPS encrypts traffic so passwords, form data and cookies can't be read or tampered with in transit.
• SEO. Search engines favour secure sites, and some modern browser features only work over HTTPS.
• It's free. Let's Encrypt, a non-profit certificate authority, issues trusted certificates at no cost, so the old excuse of "certs are expensive" is gone.

What Let's Encrypt is (and the one catch)

Let's Encrypt issues free, automated, 90-day certificates. The short lifespan sounds like a downside but it's the opposite: it *forces* automation, and automation is what stops certificates from ever expiring by surprise. A tool called Certbot does the issuing and — crucially — sets up automatic renewal so you never touch it again.

The one prerequisite: your domain must already point at your server. A certificate is issued *for a domain*, and Let's Encrypt proves you control it by checking the live DNS/HTTP response. So set your A record to your VPS IP first and confirm it resolves before you start.

Step 1: Point your domain at the VPS

In your DNS host, create an A record for your domain pointing at your VPS's public IP (and an AAAA record if you use IPv6). Verify it's live:

dig yourdomain.com +short

You want your VPS IP to come back. If it doesn't yet, wait for propagation before continuing — Certbot's validation will fail against a domain that doesn't resolve to your server.

Step 2: Install Certbot

On Ubuntu/Debian with Nginx, the quickest route:

sudo apt update
sudo apt install certbot python3-certbot-nginx

There are plugins for Apache too (python3-certbot-apache), and a standalone mode if you're not running a supported web server.

Step 3: Issue the certificate

Let Certbot handle both issuing the certificate *and* configuring Nginx to use it:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot will validate that you control the domain, obtain the certificate, edit your Nginx config to serve HTTPS, and offer to redirect all HTTP traffic to HTTPS (say yes). List every hostname you want covered with additional -d flags. Within a minute your site is live on https:// with a valid, browser-trusted certificate.

Step 4: Confirm auto-renewal is set up

This is the step that saves you from a future outage. Certbot installs a systemd timer (or cron job) that renews certificates automatically before they expire. Prove it works with a dry run:

sudo certbot renew --dry-run

If that completes without error, your renewals are handled. Certbot renews well before the 90-day mark, reloads your web server, and you never have to think about it. Check the timer any time with:

systemctl list-timers | grep certbot

Step 5: Verify from the outside

Browsers can hide a missing intermediate certificate — a chain that "works for me" but fails for other clients. Confirm the certificate is serving correctly to the whole internet, not just your browser, with an external SSL checker: it reports the expiry date, days remaining, issuer, covered hostnames and the full chain in one view. Our free tool at /tools/ssl-checker does exactly this — run it right after issuing to be sure everything's clean.

The easier path: a control panel

If you'd rather not touch the command line at all, deploy a one-click control-panel image (CyberPanel, cPanel, Plesk and the like). These issue and auto-renew Let's Encrypt certificates for a site with a single click, managing everything behind a friendly UI. On Nxeon you can pick such an image at deploy time, so HTTPS is handled from first boot.

Common issues and fixes

• Validation failed. The domain isn't pointing at this server yet, or port 80/443 is blocked. Confirm DNS resolves to your VPS and the ports are open.
• "Unable to get local issuer certificate." A missing intermediate — make sure the server sends the full chain (fullchain.pem, which Certbot uses by default).
• Certificate covers the wrong names. Reissue with the correct -d flags for every hostname you serve.
• Mixed-content warnings. The certificate is fine, but the page loads some assets over http://. Update those URLs to https:// or protocol-relative.

Set it and forget it

Free HTTPS is one command away, and once auto-renewal is confirmed it's genuinely maintenance-free. On a Nxeon VPS you have the full root access to run Certbot your way — or a one-click panel to do it for you — with no shared-hosting restrictions in the way. Deploy a server at /vps, point your domain, run Certbot, and verify with /tools/ssl-checker. Then never think about certificate expiry again.