How to Set Up an SSL Certificate on a VPS: Complete Step-by-Step Guide

Posted by admin_hostmosaic 13 Min Read

Why SSL Certificates Matter for Your VPS

Every website running on a VPS without an SSL certificate is sending data in plain text. According to Google’s Transparency Report, over 95% of web traffic now uses HTTPS, and browsers like Chrome actively flag unencrypted sites as “Not Secure.” Beyond trust signals, SSL certificates encrypt data between your server and visitors, protecting login credentials, payment information, and personal data from interception.

For VPS owners specifically, the responsibility falls entirely on you. Unlike shared hosting where the provider handles SSL configuration, a VPS gives you full control — and full accountability. The good news: setting up SSL on a VPS is straightforward once you understand the process, and free options like Let’s Encrypt make cost a non-issue.

Types of SSL Certificates: Which One Do You Need?

Why SSL Certificates Matter for Your VPS
Why SSL Certificates Matter for Your VPS

Before installing anything, you need to pick the right certificate type for your use case:

Certificate Type Validation Level Best For Cost Issuance Time
Domain Validated (DV) Domain ownership only Blogs, personal sites, small projects Free – $50/year Minutes
Organization Validated (OV) Domain + business verification Business websites, SaaS apps $50 – $200/year 1–3 days
Extended Validation (EV) Full legal entity verification E-commerce, banking, enterprise $100 – $500/year 3–7 days
Wildcard Covers all subdomains Multi-subdomain setups $50 – $300/year Varies

For most VPS owners running web applications or WordPress sites, a free DV certificate from Let’s Encrypt is the practical choice. According to Let’s Encrypt’s own statistics, they’ve issued over 4 billion certificates since 2015, serving more than 360 million websites worldwide.

Prerequisites: What You Need Before Starting

Before you set up an SSL certificate on your VPS, confirm these requirements:

  • A registered domain name pointing to your VPS IP address (A record configured in DNS)
  • Root or sudo access to your VPS via SSH
  • A web server installed — Nginx or Apache (this guide covers both)
  • Port 80 and 443 open in your firewall (UFW, iptables, or cloud provider firewall)
  • DNS propagation complete — verify with dig yourdomain.com +short returning your VPS IP

If your domain’s DNS hasn’t propagated yet, SSL issuance will fail. According to Cloudflare’s documentation, DNS changes typically propagate within 24–48 hours, though most updates complete in under 1 hour with modern providers like Cloudflare or Route 53.

Step 1: Install Certbot on Your VPS

Certbot is the official client for Let’s Encrypt, maintained by the Electronic Frontier Foundation (EFF). It automates certificate issuance and renewal. Here’s how to install it on the most common VPS operating systems:

Ubuntu/Debian

sudo apt update
sudo apt install certbot -y
# For Nginx:
sudo apt install python3-certbot-nginx -y
# For Apache:
sudo apt install python3-certbot-apache -y

CentOS/RHEL/AlmaLinux

sudo dnf install epel-release -y
sudo dnf install certbot -y
# For Nginx:
sudo dnf install python3-certbot-nginx -y
# For Apache:
sudo dnf install python3-certbot-apache -y

Verify the installation by running certbot --version. As of 2026, Certbot version 3.x is the current stable release with improved ACME protocol support and faster validation times.

Step 2: Set Up SSL Certificate on VPS with Nginx

If you’re running Nginx (which according to W3Techs powers approximately 34% of all websites), Certbot can automatically configure SSL for you:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot will:

  1. Verify domain ownership via HTTP-01 challenge (places a temporary file in your web root)
  2. Download the certificate and private key to /etc/letsencrypt/live/yourdomain.com/
  3. Modify your Nginx server block to include SSL directives
  4. Set up automatic HTTP-to-HTTPS redirect

After completion, your Nginx configuration will include these critical lines:

server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
}

Test your configuration with sudo nginx -t before reloading: sudo systemctl reload nginx.

Step 3: Set Up SSL Certificate on VPS with Apache

For Apache users (still powering around 30% of active sites according to Netcraft’s 2026 Web Server Survey), the process is equally simple:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot handles the Apache configuration automatically, enabling the ssl module and creating a new VirtualHost on port 443. The resulting configuration looks like:

<VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    DocumentRoot /var/www/yourdomain
    
    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/yourdomain.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/yourdomain.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>

Enable the required modules if they aren’t already active:

sudo a2enmod ssl
sudo a2enmod headers
sudo systemctl restart apache2

Step 4: Configure Automatic Certificate Renewal

Let’s Encrypt certificates expire every 90 days — a deliberate design choice that encourages automation. Certbot installs a systemd timer (or cron job) that attempts renewal twice daily. Verify it’s active:

sudo systemctl status certbot.timer
# Or check the cron entry:
sudo certbot renew --dry-run

The --dry-run flag simulates renewal without making changes. If this succeeds, your auto-renewal is properly configured. According to Let’s Encrypt’s best practices documentation, certificates are only renewed when they have fewer than 30 days remaining, so the twice-daily check is lightweight and won’t hit rate limits.

For additional reliability, you can add a post-renewal hook to reload your web server:

# /etc/letsencrypt/renewal-hooks/deploy/reload-webserver.sh
#!/bin/bash
systemctl reload nginx  # or apache2

Step 5: Harden Your SSL Configuration

A basic SSL setup works, but a hardened configuration scores higher on security audits and protects against known vulnerabilities. According to Qualys SSL Labs, only about 20% of HTTPS-enabled sites achieve an A+ rating. Here’s how to join that group:

Disable Outdated Protocols

TLS 1.0 and 1.1 are deprecated as of RFC 8996 (published March 2021). Only allow TLS 1.2 and 1.3:

# Nginx
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers off;

Enable HSTS (HTTP Strict Transport Security)

HSTS tells browsers to always use HTTPS for your domain, preventing downgrade attacks:

# Nginx
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

Enable OCSP Stapling

OCSP stapling improves SSL handshake performance by 100–300ms according to benchmarks from KeyCDN, because the server provides certificate validity proof directly instead of forcing the browser to check separately:

# Nginx
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

Step 6: Verify Your SSL Installation

After completing the setup, verify everything works correctly using these tools:

  • Qualys SSL Labs Test (ssllabs.com/ssltest) — comprehensive grading from A+ to F
  • Mozilla Observatory (observatory.mozilla.org) — checks security headers alongside SSL
  • Command line verification:
# Check certificate details
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com

# Verify certificate chain
curl -vI https://yourdomain.com 2>&1 | grep -A 5 'Server certificate'

A properly configured SSL setup should show:

  • Valid certificate chain (root CA → intermediate → your cert)
  • TLS 1.2 or 1.3 negotiated
  • No mixed content warnings in browser console
  • HSTS header present in response

Troubleshooting Common SSL Issues on VPS

Even with a straightforward process, things can go wrong. Here are the most frequent problems VPS owners encounter when setting up SSL certificates:

Challenge Failed: DNS Not Pointing to Server

If Certbot returns “Challenge failed” or “unauthorized,” your domain’s A record likely doesn’t point to your VPS IP. Fix this in your DNS provider’s dashboard and wait for propagation. Use dig +short yourdomain.com to confirm.

Port 80 Blocked by Firewall

The HTTP-01 challenge requires port 80 to be accessible. If you’re using UFW:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw reload

Rate Limits Hit

Let’s Encrypt enforces rate limits: 50 certificates per registered domain per week, and 5 failed validations per hostname per hour. If you hit these during testing, use the staging environment:

sudo certbot --staging --nginx -d yourdomain.com

Mixed Content Warnings After SSL Installation

If your site loads over HTTPS but the browser shows warnings, you have resources (images, scripts, stylesheets) still loading over HTTP. For WordPress sites, update the Site URL in Settings, then use a plugin like Better Search Replace to update database URLs from http:// to https://.

Alternative: Using Cloudflare SSL with Your VPS

If you prefer not to manage certificates directly on your server, Cloudflare offers a proxy-based SSL solution. According to Cloudflare’s 2025 annual report, they handle SSL termination for over 25 million internet properties. Here’s how it works with a VPS:

  1. Point your domain’s nameservers to Cloudflare
  2. Enable “Full (Strict)” SSL mode in the Cloudflare dashboard
  3. Install a Cloudflare Origin Certificate on your VPS (valid for 15 years, but only trusted by Cloudflare’s edge)
  4. Cloudflare handles the public-facing certificate and renewal automatically

This approach adds DDoS protection and CDN caching as bonuses, but introduces a dependency on Cloudflare’s infrastructure. For full control, the direct Certbot method described above remains the standard approach.

SSL Certificate Monitoring and Maintenance

Setting up SSL is not a one-time task. Ongoing monitoring prevents unexpected expiration and downtime:

  • UptimeRobot (free tier) — monitors SSL expiry and alerts 14 days before expiration
  • Certbot timer logs — check with journalctl -u certbot.timer for renewal failures
  • SSL certificate expiry check script:
#!/bin/bash
EXPIRY=$(echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>/dev/null | openssl x509 -noout -enddate)
echo "Certificate expires: $EXPIRY"

Set this as a weekly cron job that emails you if expiry is within 14 days. Combined with Certbot’s auto-renewal, this provides a safety net against certificate lapses that could cost you traffic and search rankings.

Key Takeaways

Setting up an SSL certificate on a VPS takes about 10–15 minutes with Certbot and Let’s Encrypt. The process involves installing Certbot, running a single command for your web server (Nginx or Apache), verifying auto-renewal works, and hardening your configuration for an A+ security rating. Free DV certificates from Let’s Encrypt are sufficient for the vast majority of websites, and the 90-day expiry cycle is handled entirely by automated renewal.

For VPS owners who want to set up SSL certificates correctly the first time: follow the steps above, test with SSL Labs, and monitor expiry dates. Your visitors get encrypted connections, search engines reward you with better rankings, and you avoid the “Not Secure” browser warning that drives away 85% of potential customers according to a 2024 HubSpot survey on website trust signals.