Admin: New server guide

2026-04-14T20:00:19Z

New server guide

New page

Are you looking to secure your website with an SSL certificate without any cost? Setting up Let's Encrypt SSL certificates is an excellent way to achieve this. A Let's Encrypt SSL certificate encrypts the data transferred between your web server and visitors' browsers, indicated by a padlock icon in the address bar. This tutorial will guide you through the installation and configuration process using Certbot, a widely-used tool for managing Let's Encrypt certificates.

== Prerequisites ==

Before you begin, ensure you have the following:

* A server running a supported Linux distribution (e.g., Ubuntu, Debian, CentOS).
* Full root or sudo access to your server. If you're using a dedicated server, providers like [https://powervps.net/?from=32 PowerVPS] offer full root access, which is ideal for this kind of configuration.
* A registered domain name pointing to your server's IP address.
* A web server installed and running (e.g., Apache or Nginx).
* Your firewall configured to allow traffic on ports 80 (HTTP) and 443 (HTTPS).

== Understanding Let's Encrypt and Certbot ==

Let's Encrypt is a free, automated, and open Certificate Authority (CA). It provides digital certificates that enable encrypted connections (HTTPS) for websites. These certificates are typically valid for 90 days, but automation tools like Certbot handle their renewal.

Certbot is a client that automates the process of obtaining and renewing Let's Encrypt certificates. It interacts with the Let's Encrypt servers to verify domain ownership and then configures your web server to use the issued certificate.

== Installing Certbot ==

The installation method for Certbot can vary slightly depending on your operating system. We'll cover common distributions.

=== For Ubuntu/Debian ===

First, update your package list:
<pre>sudo apt update</pre>

Then, install Certbot and its plugin for your web server. For Apache:
<pre>sudo apt install certbot python3-certbot-apache</pre>

For Nginx:
<pre>sudo apt install certbot python3-certbot-nginx</pre>

=== For CentOS/RHEL ===

First, enable the EPEL (Extra Packages for Enterprise Linux) repository if it's not already enabled:
<pre>sudo yum install epel-release</pre>

Then, install Certbot and its plugin. For Apache:
<pre>sudo yum install certbot python2-certbot-apache</pre>

For Nginx:
<pre>sudo yum install certbot python2-certbot-nginx</pre>

== Obtaining Your First SSL Certificate ==

Once Certbot is installed, you can obtain your first certificate. Certbot can automatically configure your web server, or you can choose to obtain the certificate only and configure it manually.

=== For Apache ===

To obtain a certificate and automatically configure Apache:
<pre>sudo certbot --apache</pre>

Certbot will prompt you for your domain name(s) and email address. It will then attempt to obtain the certificate and modify your Apache configuration to use it.

=== For Nginx ===

To obtain a certificate and automatically configure Nginx:
<pre>sudo certbot --nginx</pre>

Similar to the Apache command, Certbot will ask for your domain name(s) and email address, then proceed with obtaining and configuring the certificate.

If you prefer to obtain the certificate without automatic configuration, you can use the `certonly` command:
<pre>sudo certbot certonly --webroot -w /var/www/html -d your_domain.com -d www.your_domain.com</pre>

Replace `/var/www/html` with your website's document root and `your_domain.com` with your actual domain.

== Verifying Auto-Renewal ==

Let's Encrypt certificates are valid for 90 days. Certbot automatically sets up a systemd timer or cron job to renew your certificates before they expire. You can test the renewal process (without actually renewing) using:
<pre>sudo certbot renew --dry-run</pre>

If this command completes without errors, your auto-renewal is likely set up correctly.

== Setting Up Wildcard SSL Certificates ==

A wildcard SSL certificate secures a domain and all its subdomains (e.g., `*.your_domain.com`). This is particularly useful for websites with many subdomains. Obtaining a wildcard certificate requires using the DNS challenge method, as it cannot be verified through HTTP.

To obtain a wildcard certificate, you'll need a Certbot plugin that supports DNS authentication. The `certbot-dns-cloudflare` plugin is a popular choice if you use Cloudflare for DNS.

First, install the plugin:
<pre>sudo apt install python3-certbot-dns-cloudflare</pre> (for Ubuntu/Debian)
<pre>sudo yum install certbot-dns-cloudflare</pre> (for CentOS/RHEL)

Next, you'll need to create a credentials file for your DNS provider. For Cloudflare, this would involve creating a file (e.g., `/etc/letsencrypt/cloudflare.ini`) with your API credentials:
<pre>dns_cloudflare_email = your_cloudflare_email@example.com
dns_cloudflare_api_key = your_cloudflare_api_key</pre>

Secure this file:
<pre>sudo chmod 600 /etc/letsencrypt/cloudflare.ini</pre>

Finally, obtain the wildcard certificate:
<pre>sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
-d your_domain.com \
-d '*.your_domain.com'</pre>

You will then need to manually configure your web server to use this certificate.

== Troubleshooting ==

* **"Too many attempted certificates" error**: Let's Encrypt has rate limits. If you encounter this, wait a week or use the `--dry-run` option for testing.
* **Firewall blocking**: Ensure ports 80 and 443 are open in your server's firewall.
* **Web server not restarting**: Check your web server's error logs for specific issues related to SSL configuration. For Apache, check `/var/log/apache2/error.log`; for Nginx, check `/var/log/nginx/error.log`.
* **Certbot command not found**: Ensure Certbot was installed correctly and that its executable is in your system's PATH.

== Related Articles ==

* [[Web Server Configuration]]
* [[Firewall Management]]
* [[Domain Name System (DNS)]]

[[Category:Web Server Setup]]
[[Category:Security]]
[[Category:SSL Certificates]]

***

**Disclosure:** This article contains affiliate links. If you click on a link to [https://powervps.net/?from=32 PowerVPS] and make a purchase, we may receive a commission at no extra cost to you. This helps support our work.

Setting Up Let's Encrypt SSL Certificates - Revision history

Admin: New server guide