How to Configure SSL/HTTPS for a Website

Running a modern website without HTTPS encryption is no longer acceptable. Web browsers flag unencrypted HTTP sites as "Not Secure," search engines penalize non-HTTPS domains in SEO rankings, and sensitive user data (passwords, credit cards, cookies) can be intercepted in plain text over public Wi-Fi networks.

Thanks to Let's Encrypt and the Certbot automation client from the Electronic Frontier Foundation (EFF), securing your website with trusted SSL/TLS certificates on your RivinCloud VPS is completely free and takes less than three minutes.

1. Prerequisites

Before issuing an SSL certificate, ensure:

1. Your domain name (e.g., example.com and www.example.com) points directly to your server's public IP address via DNS A records.
2. Your web server (Nginx or Apache) is installed and actively serving your website over port 80.
3. Your firewall (UFW) allows HTTPS traffic (sudo ufw allow 443/tcp).

2. Installing Certbot

Install Certbot and the corresponding web server plugin using apt:

For Nginx:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

For Apache:

sudo apt update
sudo apt install certbot python3-certbot-apache -y

3. Obtaining and Installing the SSL Certificate

Run Certbot with the web server plugin:

Automated Setup for Nginx:

sudo certbot --nginx -d example.com -d www.example.com

Automated Setup for Apache:

sudo certbot --apache -d example.com -d www.example.com

What Certbot Does Automatically:

1. Contacts the Let's Encrypt ACME server.
2. Serves a temporary cryptographic challenge file under /.well-known/acme-challenge/ to prove you control the domain.
3. Issues a validated SSL/TLS certificate and private key to /etc/letsencrypt/live/example.com/.
4. Updates your Nginx/Apache configuration to enable port 443 and forces automatic redirection from HTTP to HTTPS!

4. Testing Automatic Certificate Renewal

Let's Encrypt certificates are valid for 90 days. Certbot automatically installs a background systemd timer (certbot.timer) that checks twice daily for certificates expiring within 30 days and renews them automatically.

Test the Renewal Process (Dry Run)

sudo certbot renew --dry-run

(If this simulation outputs Congratulations, all simulated renewals succeeded, your auto-renewal is fully operational).

Check the Systemd Timer Status

systemctl status certbot.timer

5. Verifying SSL Health

Open your web browser and visit https://example.com. Look for the secure padlock icon in the URL address bar.

For a comprehensive security audit of your SSL configuration (ciphers, TLS 1.3 support, forward secrecy), test your domain on SSL Labs: https://www.ssllabs.com/ssltest/

Common Mistakes

• Running Certbot before DNS propagates: Let's Encrypt servers will fail to verify domain ownership if your A record hasn't fully updated globally.
• Firewall blocking Port 443: Always run sudo ufw allow 'Nginx Full' before issuing SSL.

Troubleshooting

• Certbot fails with "Challenge failed for domain":
  1. Verify port 80 is reachable: curl -I http://example.com.
  2. Verify no proxy or CDN is blocking /.well-known/ paths.
  3. Ensure server_name in Nginx accurately matches the requested domain.

Best Practices

• Enable HTTP/2 in Nginx for faster multiplexed HTTPS connection speed: listen 443 ssl http2;.
• Add HTTP Strict Transport Security (HSTS) headers to enforce HTTPS across all client browsers.

Frequently Asked Questions

Is a Let's Encrypt SSL certificate as secure as a paid certificate?

Yes! Let's Encrypt uses the exact same industry-standard 256-bit AES / RSA 4096-bit and ECC cryptographic encryption as expensive commercial certificates.

Conclusion

Securing your website with Let's Encrypt and Certbot on your RivinCloud VPS ensures maximum user trust, improved SEO rankings, and airtight data encryption!