Installing a free SSL certificate on a VPS
A VPS has no control panel to issue certificates for you. Use Let's Encrypt via Certbot — and test that renewal works, because a silent failure only surfaces 90 days later.
A VPS has no control panel, so nothing issues a certificate for you. The standard answer is Let's Encrypt via Certbot: free, trusted by every browser, and it renews itself once set up.
Before you start
- The domain's A record must already point at the VPS. Certbot proves you control the domain by being reached at it, so this has to be true first — see Pointing your domain at your hosting.
- Ports 80 and 443 must be open. Port 80 is not optional: it is how validation works, even for a site that only serves HTTPS.
- Root or
sudoaccess over SSH — see VPS SSH access and management.
Install Certbot and issue the certificate
On Ubuntu or Debian with Nginx:
sudo apt update && sudo apt install certbot python3-certbot-nginx
sudo certbot --nginx -d example.com -d www.example.com
For Apache, install python3-certbot-apache and use --apache instead. Certbot edits the web-server config, obtains the certificate and offers to redirect HTTP to HTTPS — accept that.
List both the bare domain and www in one command. A certificate only covers the names on it, and a visitor typing the version you left out gets a browser warning.
Check that renewal actually works
Let's Encrypt certificates last 90 days. Certbot installs a timer to renew them, but a renewal that silently fails does not surface until the certificate expires — roughly three months after the thing that broke it. Test it deliberately:
sudo certbot renew --dry-run
If that succeeds, renewal is genuinely working. Run it again after any change to your firewall, web-server config or DNS.
Behind Cloudflare
If the domain is proxied through Cloudflare, HTTP-01 validation still needs port 80 reachable. Either keep it open, or switch that domain to DNS-01 validation. Set Cloudflare's SSL mode to Full (strict) once the certificate is installed — see Cloudflare SSL modes, and the redirect loop they cause.
If you would rather not do this yourself
Two alternatives: run Shared or WordPress Hosting instead, where Plesk handles certificates for you, or buy a validated certificate from dash.mypandos.io under Products → SSL Certificates and install it manually. If you get stuck, open a ticket from the Support section with the domain and the exact Certbot error — that output usually identifies the problem immediately.