SSL/TLS certificates are no longer optional - they are a requirement for every website. They encrypt data in transit, boost your SEO rankings, enable HTTP/2 performance benefits, and build user trust. Let's Encrypt provides free, automated SSL certificates, and Certbot makes the process seamless on your SakuraHost VPS.

Prerequisites: A SakuraHost VPS with Nginx installed and a domain name pointing to your server's IP address. DNS propagation must be complete before requesting a certificate. See our guides: Getting Started with Your SakuraHost VPS and Installing and Configuring Nginx on Your SakuraHost VPS.

1. Installing Certbot

Certbot is the official Let's Encrypt client. The recommended installation method uses snap, which ensures you always have the latest version.

Install snapd and Certbot:
sudo apt update sudo apt install snapd -y sudo snap install core; sudo snap refresh core sudo snap install --classic certbot
Create a symbolic link to make certbot available system-wide:
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Verify the installation with certbot --version.

2. Obtaining Your SSL Certificate

Certbot's Nginx plugin handles everything automatically - obtaining the certificate, modifying your Nginx configuration, and setting up HTTPS redirects.

Run Certbot with the Nginx plugin:
sudo certbot --nginx -d example.com -d www.example.com

You will be prompted to:

  1. Enter your email address for renewal notifications
  2. Accept the Let's Encrypt Terms of Service
  3. Choose whether to redirect HTTP to HTTPS (recommended: select option 2 for redirect)

Certbot will automatically verify domain ownership via HTTP-01 challenge, download the certificate, update your Nginx configuration, and reload the server.

DNS Must Be Ready: Your domain must have an A record pointing to your VPS IP address before running Certbot. If verification fails, check your DNS settings in your domain registrar or DNS manager. SakuraHost clients can manage DNS at billing.sakurahost.co.tz.

3. Understanding What Certbot Changes

After running Certbot, your Nginx server block will include additional directives. Here is what a secured configuration looks like:

server { listen 80; server_name example.com www.example.com; return 301 https://$server_name$request_uri; } server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name example.com www.example.com; ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; include /etc/letsencrypt/options-ssl-nginx.conf; ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; root /var/www/example.com/html; index index.html; location / { try_files $uri $uri/ =404; } }

The first server block redirects all HTTP traffic to HTTPS. The second block handles encrypted HTTPS connections with the Let's Encrypt certificate files.

4. Optimizing SSL Configuration

Strengthen your SSL configuration for an A+ rating on SSL Labs by adding these settings to your server block:

# Strong SSL settings ssl_protocols TLSv1.2 TLSv1.3; ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384; ssl_prefer_server_ciphers off; # HSTS (HTTP Strict Transport Security) - 1 year add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always; # OCSP Stapling ssl_stapling on; ssl_stapling_verify on; resolver 8.8.8.8 8.8.4.4 valid=300s; resolver_timeout 5s; # Session optimization ssl_session_cache shared:SSL:10m; ssl_session_timeout 1d; ssl_session_tickets off;

After making changes, always test and reload:

sudo nginx -t sudo systemctl reload nginx

5. Automatic Certificate Renewal

Let's Encrypt certificates expire every 90 days. Certbot installs a systemd timer that automatically checks for renewal twice daily.

Verify the renewal timer is active:
sudo systemctl status snap.certbot.renew.timer
Test the renewal process (dry run):
sudo certbot renew --dry-run

If the dry run succeeds, your certificates will renew automatically without intervention. Certbot also reloads Nginx after renewal.

Manual Renewal

If you ever need to force a renewal:

sudo certbot renew --force-renewal sudo systemctl reload nginx

6. Managing Multiple Domains

You can secure additional domains by running Certbot again:

# New domain sudo certbot --nginx -d newsite.com -d www.newsite.com # Add subdomain to existing certificate sudo certbot --nginx --expand -d example.com -d www.example.com -d api.example.com

Wildcard Certificates

For wildcard certificates (covering all subdomains), use DNS verification:

sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

You will be prompted to create a DNS TXT record. This approach requires manual renewal unless you configure a DNS plugin for your provider.

7. Troubleshooting Common Issues

  • "Challenge failed" error - Ensure ports 80 and 443 are open in your firewall (sudo ufw allow 'Nginx Full') and DNS points to your server
  • "Too many certificates" error - Let's Encrypt limits you to 50 certificates per registered domain per week. Use the staging environment for testing: --staging flag
  • Mixed content warnings - Update all internal links, image URLs, and script references to use HTTPS or protocol-relative URLs
  • Renewal failures - Check /var/log/letsencrypt/letsencrypt.log for detailed error messages
Verify Your SSL: After setup, test your configuration at SSL Labs Server Test. Aim for an A+ rating. For the official Certbot documentation, visit certbot.eff.org. Questions? Reach our team at billing.sakurahost.co.tz.
Was this answer helpful? 0 Users Found This Useful (0 Votes)

Most Popular Articles

Getting Started with Your SakuraHost VPS: Initial Server Setup

.kb-article { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;...
How to Secure Your VPS: SSH Keys, Firewall, and Fail2ban

.kb-article { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;...
Installing and Configuring Nginx on Your SakuraHost VPS

.kb-article { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;...
How to Deploy a Node.js Application on Your VPS with PM2

.kb-article { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;...
Docker on SakuraHost VPS: Container Deployment Made Easy

.kb-article { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, sans-serif;...