Skip to main content
A certificate lets a site on your server open over HTTPS. A server for a VPN or software without a site most likely doesn’t need SSL.

​
Options

  • Universal SSL – automatic in Cloudflare, encrypts “browser ↔ Cloudflare”.
  • CF Origin CA – a free Cloudflare certificate for the server for 15 years, encrypts “Cloudflare ↔ server”.
  • Let’s Encrypt – a public certificate for the server for 90 days, with auto-renewal.
For a live site: Let’s Encrypt on the server and the Full (strict) mode in the Cloudflare settings, then traffic is encrypted from the browser to the server.

​
Installation

Connect over SSH as root: Connection. The commands are for Ubuntu, it is installed by default. Before you start, check:
  • A record – the domain points to the Server IP from the card: Connect a domain.
  • Ports 80 and 443 – open in the firewall: Firewall.
  • Web server – nginx or apache is running: Web server.
  1. Update the system:
  2. Install certbot – for Apache install python3-certbot-apache instead of python3-certbot-nginx:
  3. Get the certificate – certbot issues it and adds it to the Nginx config by itself. For Apache replace --nginx with --apache:
    Files only, without config changes: sudo certbot certonly --nginx -d example.com -d www.example.com. They go to /etc/letsencrypt/live/example.com/.

​
Renewal

The certificate is valid for 90 days, certbot sets up a system auto-renewal timer by itself. Check:

​
Wildcard

A certificate for *.example.com is issued only via the DNS challenge:
Certbot asks you to create a _acme-challenge TXT record in the domain’s DNS. Wait for the record to propagate, and only then press Enter. Such a certificate does not renew by itself: run the command again before the 90 days are up.

​
Errors

  • Timeout – port 80 is closed, open it in the firewall.
  • Domain not found – the A record hasn’t propagated yet: wait and check DNS.
  • Connection refused – nginx or apache isn’t running: sudo systemctl start nginx.
  • Rate limit – too many requests, wait. Limit: 5 failures per hour, 50 certificates per domain per week.
Next: Web server, Server hardening.