Free SSL with Let's Encrypt on a VPS: the complete 2026 guide

To get free SSL from Let's Encrypt on a VPS you need three things: a domain that points to the server's IP, port 80 open to the internet, and an ACME client such as Certbot to request and renew the certificate. On Ubuntu with nginx that means installing Certbot and running sudo certbot --nginx; with a control panel such as ZoPanel, the certificate is issued and renewed automatically when you create the website.

This guide covers both routes, explains how Let's Encrypt validates your domain, how to get a wildcard certificate, which rate limits to know, the important certificate lifetime changes coming in 2027 and 2028, and how to fix the errors that make issuance fail.

How does Let's Encrypt work?

Let's Encrypt is a free, automated certificate authority (CA). Certificates are issued over the ACME protocol: a client on your server proves you control the domain, and Let's Encrypt issues a certificate that every major browser trusts.

There are two common ways to prove control, described in Let's Encrypt's challenge types documentation:

Challenge	How it works	Pros	Cons
HTTP-01	Serve a file at http://domain/.well-known/acme-challenge/	Simple, no DNS access needed	Port 80 only; no wildcards
DNS-01	Create a _acme-challenge TXT record	Wildcards (*.example.com), no port 80 needed	Needs DNS API or control of the zone

For ordinary websites HTTP-01 is all you need. Use DNS-01 only when you need a wildcard.

Before you install free SSL from Let's Encrypt

1. The domain points to the right IP. Check:

dig +short example.com A
dig +short www.example.com A
dig +short example.com AAAA

If the domain has an AAAA (IPv6) record pointing somewhere else, validation can fail, because Let's Encrypt will try to connect over IPv6. Remove the wrong AAAA record or point it at the VPS's IPv6 address.

2. Port 80 is open, in UFW and in your provider's cloud firewall:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

3. nginx has a server block with server_name example.com www.example.com; for the site.

If the domain is not pointed yet, see how to point a domain to a VPS.

Option 1: Install Let's Encrypt SSL by hand with Certbot

Install Certbot

Certbot is the ACME client from the EFF. The official Certbot instructions recommend the snap:

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

On Debian 12 (no snap by default), or if you prefer apt packages, use the distribution's package:

sudo apt install certbot python3-certbot-nginx

Pick one method, not both.

Get a certificate for nginx

sudo certbot --nginx -d example.com -d www.example.com

Certbot asks for an email address and agreement to the terms, validates the domain over HTTP-01, then edits the nginx configuration to use the certificate and, if you choose, redirect HTTP to HTTPS. Files live in /etc/letsencrypt/live/example.com/.

To edit nginx yourself, run sudo certbot certonly --nginx -d example.com and add the fullchain.pem and privkey.pem paths to the server block.

Check automatic renewal

Both the snap and the apt package install a systemd timer for renewal. Check it:

systemctl list-timers | grep -i certbot
sudo certbot renew --dry-run

If the dry run succeeds, renewal is automated.

Wildcard certificates

Wildcards need DNS-01. certbot certonly --manual --preferred-challenges dns works, but it does not renew by itself: you would have to create a new TXT record by hand each time. In practice, use the Certbot DNS plugin for your DNS provider (Cloudflare, Route 53 and others) so Certbot creates the record through the provider's API.

Option 2: Free SSL on autopilot with ZoPanel

Once you manage more than a handful of sites, doing this per domain gets tedious. In ZoPanel, Let's Encrypt is the default (SSL docs):

1. Set the Administrator email in Settings (Let's Encrypt registration needs it).
2. Create the site under Websites → New website with Free SSL (Let's Encrypt) on.
3. If the domain already points to the server, the certificate is issued straight away. If not, the site works over HTTP and ZoPanel re-checks DNS every hour; once the domain resolves to the server, the certificate is issued. After a failure, the next attempt waits 2, 4, 8 hours and so on, up to a day, so rate limits are never wasted.
4. On the website's SSL tab, turn on Redirect HTTP to HTTPS. ZoPanel also sends a one-year HSTS header, so only turn it on when you intend to keep HTTPS.

What ZoPanel adds:

• Renewal: hourly checks, renewal when fewer than 30 days remain, and retries after 1, 2, 4, then 8 days if renewal fails.
• Alerts: SSL renewal failed with the exact error goes to the administrator and the site owner, and SSL expiring soon is sent daily once a certificate has fewer than 14 days left.
• Wildcards: install the DNS server, create the domain's zone (DNS) and tick Also *.example.com (wildcard) on the SSL tab. ZoPanel validates over DNS and renews automatically.
• Bought certificates: paste the PEM certificate and key into Custom certificate; ZoPanel checks that the key matches, the domain is right and it has not expired.
• Aliases that do not resolve yet are left out so they cannot fail the whole order, and are added on the next issue.

What is changing: shorter certificates and no reminder emails

Two changes make automation non-negotiable:

Let's Encrypt stopped sending expiry reminder emails on 4 June 2025 (announcement). If you relied on those emails to notice a failed renewal, you now need your own monitoring.

Certificate lifetimes are shrinking. According to Let's Encrypt's plan:

Date	Change to the default profile
Today	90-day certificates
10 February 2027	64-day certificates; validation reuse drops to 10 days
16 February 2028	45-day certificates; validation reuse drops to 7 hours

Let's Encrypt recommends ACME Renewal Information (ARI) where your client supports it, or renewing about two-thirds of the way through a certificate's life. A fixed "renew every 60 days" cron job will stop working. Make sure your client schedules renewals from the real expiry date.

Let's Encrypt rate limits

From the rate limits page:

Limit	Value
New certificates per registered domain	50 per 7 days
Duplicate certificates (identical set of names)	5 per 7 days
Failed validations per name, per account	5 per hour
New orders per account	300 per 3 hours

The usual way to hit a limit is re-running the command while DNS is still wrong and running into the 5-failures-per-hour limit. When experimenting, use --dry-run or the staging environment (--test-cert).

Common SSL errors and how to fix them

Symptom	Usual cause	Fix
Timeout during connect	Port 80 blocked in UFW or the cloud firewall	Open port 80 in both
NXDOMAIN or wrong IP	Domain not pointed yet, DNS not propagated	Check with dig, wait for the TTL
Validation fails although IPv4 is right	Wrong AAAA record	Remove or fix the AAAA record
CAA record prevents issuance	CAA allows only another CA	Add 0 issue "letsencrypt.org"
Site behind Cloudflare not issued automatically	Domain resolves to Cloudflare's IPs	Issue manually or use a Cloudflare Origin certificate
Browser says "not secure" after SSL	Mixed content (http:// images or scripts)	Update URLs in the database or theme to https://

To check the certificate actually being served:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null \
  | openssl x509 -noout -issuer -dates

For sites behind Cloudflare, see using Cloudflare with a VPS.

Conclusion

Free SSL from Let's Encrypt is easy: point the domain, open port 80, run Certbot and confirm renewal with --dry-run. What matters over the next few years is automation and monitoring, because certificates will get shorter and Let's Encrypt no longer emails you before they expire.

If you look after many sites, ZoPanel issues, renews and alerts on SSL for every website automatically, including on the Free plan (10 websites, 10 databases). The details are in the SSL docs.

Frequently asked questions

Is Let's Encrypt SSL really free?

Yes. Let's Encrypt is a non-profit certificate authority whose certificates are trusted by all major browsers, at no cost. You only need an ACME client such as Certbot, or a control panel that has one built in.

How long do Let's Encrypt certificates last?

The default is currently 90 days. Under the published plan, default certificates drop to 64 days from 10 February 2027 and to 45 days from 16 February 2028, so renewal has to be automated.

Can I get a wildcard certificate from Let's Encrypt?

Yes, but only with DNS validation (DNS-01), not HTTP. Use the Certbot DNS plugin for your DNS provider, or a panel that hosts the DNS zone, such as ZoPanel, so renewals stay automatic.

Why does Certbot time out during validation?

Usually port 80 is blocked by the server's firewall or the provider's cloud firewall, or the domain does not point to the right IP yet. Check with dig and open port 80 in both UFW and the cloud firewall.

Should I use a free or a paid SSL certificate?

For most sites, including online shops, a Let's Encrypt (DV) certificate encrypts traffic just as well as a paid DV certificate. Paid OV or EV certificates are only needed when your organisation or a contract requires validated company details.