How to Get a Free SSL Certificate for Your Domain with Let's Encrypt

Want to enable HTTPS on your domain without paying for a certificate? Let's Encrypt provides free SSL/TLS certificates trusted by major browsers and operating systems. With an ACME client such as Certbot, you can request a certificate, configure your web server, and automate renewal.

This guide walks through the process for a domain hosted on a Linux server using Nginx or Apache. If your hosting provider already offers Let's Encrypt in its dashboard, you may be able to enable HTTPS with just a few clicks.

Before you start: A free certificate does not mean a domain name, hosting plan, or VPS is free. You need a registered domain and a server or hosting provider. Only configure domains and servers you own or are authorized to manage.

What is an SSL certificate?

“SSL certificate” is the common term, but modern HTTPS uses TLS (Transport Layer Security). A TLS certificate helps a browser verify that a server controls a domain and helps establish an encrypted connection.

HTTPS protects data in transit; it does not prove a website is legitimate, safe, or free of malware. You still need secure application code, authentication, authorization, and safe server configuration.

What you need

• A registered domain, such as example.com.
• Access to the domain's DNS settings.
• A Linux server or hosting account that supports Let's Encrypt.
• A web server such as Nginx or Apache, if you manage your own server.
• DNS records pointing to the correct server IP.
• For HTTP-01 validation, public reachability on port 80; port 443 must be reachable for HTTPS traffic.

How it works

Register domain
      |
      v
Point DNS to server
      |
      v
Run ACME client (e.g. Certbot)
      |
      v
Prove domain control (HTTP-01 or DNS-01)
      |
      v
Let's Encrypt issues certificate
      |
      v
Configure HTTPS + automate renewal

Let's Encrypt uses the ACME protocol. An ACME client communicates with the certificate authority and completes a challenge to prove control over the requested domain.

Step 1: Point your domain to your server

In your DNS provider's dashboard, check or create the records for your domain.

Type	Name	Value
A	@	Your server's public IPv4 address
A or CNAME	www	Your server's IP or root domain, depending on your setup
AAAA	@	Your server's IPv6 address, only if IPv6 is configured correctly

DNS providers use different interfaces. Do not add an AAAA record unless your server is actually reachable over IPv6—a stale IPv6 record can cause validation failures even if IPv4 works. Wait for DNS changes to propagate before requesting the certificate.

Step 2: Choose an installation path

Option A: Use your hosting provider

This is usually easiest if your hosting panel offers “Let's Encrypt” or “Free SSL”:

1. Open your hosting control panel.
2. Select the domain.
3. Find the SSL/TLS or Let's Encrypt section.
4. Enable or issue the certificate.
5. Enable automatic renewal if available.
6. Enable HTTPS redirection after checking that the site works over HTTPS.

Your provider may already run the ACME client for you. Follow its documentation rather than installing Certbot unnecessarily.

Option B: Use Certbot on a Linux server

Certbot is a free, open-source ACME client. Installation commands vary by operating system and web-server configuration, so select your environment on the official guide:

• Certbot installation instructions
• Let's Encrypt Getting Started

Avoid copying outdated installation commands from an old tutorial. Use the current instructions for your distribution and web server.

Step 3: Request and install the certificate

After installing Certbot and the appropriate web-server plugin, a common Nginx command is:

sudo certbot --nginx -d example.com -d www.example.com

For Apache, it is commonly:

sudo certbot --apache -d example.com -d www.example.com

Replace the example hostnames with domains you control and actually serve. Omit www if you have not configured it. These commands assume Certbot and the relevant plugin are installed; other servers and hosting platforms may require a different ACME client or method.

Certbot may ask for an email address, terms acceptance, and whether HTTP should redirect to HTTPS. Review the choices for your production environment.

HTTP-01 vs DNS-01: which should you use?

Challenge	How it works	Best for
HTTP-01	Let's Encrypt fetches a challenge file over HTTP from your domain	Most public websites with port 80 reachable
DNS-01	You publish a TXT record under _acme-challenge	Wildcard certificates or setups where HTTP validation is unsuitable

HTTP-01 requires the domain to resolve to the correct server and port 80 to be reachable. Firewalls, reverse proxies, CDNs, or redirects must not block the challenge path. HTTP-01 cannot issue wildcard certificates.

DNS-01 can issue wildcard certificates such as *.example.com. For automation, use a supported DNS plugin or provider API. Protect DNS API tokens: give them only the permissions needed to update the required zone, store them securely, and never commit them to Git.

Step 4: Verify HTTPS

Open https://example.com and check that:

• The browser shows no certificate warning.
• The certificate covers every hostname you use.
• The certificate chain is trusted.
• HTTP redirects to HTTPS if that is your intended policy.
• Pages, APIs, scripts, images, and fonts load without mixed-content errors.
• Login flows, callbacks, and webhooks still work.

You can inspect the TLS handshake from a terminal:

openssl s_client -connect example.com:443 -servername example.com

This is useful for inspecting the certificate presented by the server, but it is not a complete security audit.

Step 5: Automate renewal

Let's Encrypt certificates have short lifetimes, so automated renewal is essential. As of October 2026, the default lifetime remains 90 days, while shorter certificate profiles are also available. Let's Encrypt plans to move its default to 64 days on 10 February 2027, then to 45 days on 16 February 2028. See the official lifetime announcement.

Check certificates managed by Certbot:

sudo certbot certificates

Test the renewal process:

sudo certbot renew --dry-run

The dry run tests renewal against the staging environment; it does not replace your live certificate. Confirm that the timer or scheduled task used by your installation is enabled. Its configuration depends on how Certbot was installed.

Official references:

• Certbot renewal documentation
• Let's Encrypt certificate lifetime plans

Renewal checklist

• Confirm the ACME client's scheduled task or timer is enabled.
• Run a renewal dry run after setup and after major server changes.
• Monitor renewal failures and certificate expiry.
• Ensure the web server reloads the renewed certificate.
• Keep private keys and DNS credentials protected.
• Avoid hard-coding renewal dates based on old certificate lifetimes.

Step 6: Redirect HTTP to HTTPS carefully

Certbot may offer to configure redirection during installation. If you configure it manually, first confirm HTTPS works correctly.

Before enabling strict policies such as HSTS, verify that all affected hostnames support HTTPS. Incorrect HSTS settings can cause browsers to keep using HTTPS and make a misconfigured site difficult to access until the policy expires.

Also update canonical URLs, sitemaps, OAuth redirect URIs, webhook URLs, API base URLs, and CDN or reverse-proxy settings.

Common problems and fixes

Domain validation fails

Possible causes: DNS points to the wrong IP, port 80 is blocked, the server is unreachable, or the challenge path is intercepted. Check A/AAAA records, firewall rules, NAT, load balancers, proxy routing, and ACME logs.

Root domain works but www fails

Every requested hostname must resolve correctly and pass validation. Configure www in DNS and your web server before including it in the certificate request.

Browser says “Not secure”

Possible causes include hostname mismatch, expiration, incomplete certificate chain, or mixed content loaded over HTTP. Inspect the browser's certificate details and developer console.

Renewal fails

Check that DNS still points to the right server, the challenge can complete, credentials remain valid, and the scheduled task is running. Run sudo certbot renew --dry-run and review the full output.

You need a wildcard certificate

Use DNS-01 validation. HTTP-01 cannot validate wildcard names. Automate DNS updates with a supported plugin and a narrowly scoped API token.

You use a CDN or reverse proxy

Identify which component terminates TLS. Depending on your architecture, the browser-facing edge and your origin server may each need a certificate. A valid certificate at the edge does not automatically secure the edge-to-origin connection.

Production security best practices

• Keep the operating system, web server, ACME client, and dependencies updated.
• Protect private keys and limit file permissions.
• Never commit private keys, DNS tokens, or account credentials to a repository.
• Use modern TLS configuration supported by your server.
• Redirect HTTP to HTTPS after validating the site.
• Enable HSTS only after verifying every affected hostname supports HTTPS.
• Monitor certificate expiry and renewal failures.
• Test renewal after DNS, firewall, web-server, or proxy changes.
• Use staging for tests and avoid unnecessary production certificate requests.

Is Let's Encrypt really free?

Yes. Let's Encrypt does not charge for certificates. You may still pay for your domain registration, hosting, VPS, DNS services, or managed support. Some hosting providers include one-click issuance and renewal in their plans.

Let's Encrypt issues Domain Validation (DV) certificates. It does not issue Organization Validation (OV) or Extended Validation (EV) certificates. A DV certificate confirms control of the domain; it is not a business identity check. Read the Let's Encrypt FAQ.

Final checklist

• [ ] Domain resolves to the correct server.
• [ ] Certificate covers all required hostnames.
• [ ] HTTPS works without certificate warnings.
• [ ] HTTP redirects to HTTPS where intended.
• [ ] Important resources are not loaded over HTTP.
• [ ] Automatic renewal is enabled and a dry run succeeds.
• [ ] Renewal failures and expiry are monitored.
• [ ] Private keys and DNS API tokens are protected.

Conclusion

You do not need to buy a certificate just to enable HTTPS on a typical public website. With a registered domain, a correctly configured server, and an ACME client such as Certbot, Let's Encrypt can provide a free TLS certificate and automate its renewal.

The important part is not only issuing the certificate—it is verifying DNS, configuring HTTPS correctly, and ensuring renewal continues to work without manual intervention.

Have you set up Let's Encrypt on Nginx, Apache, a VPS, or a hosting dashboard? Share your setup and any issues in the comments.

Official resources

• Let's Encrypt — Getting Started
• Certbot — Installation instructions
• Let's Encrypt — Frequently Asked Questions
• Let's Encrypt — Certificate lifetime plans
• 64-day certificates coming in February 2027

---

About the author

Padmakar Garg is an Android Developer with 8+ years of experience in Kotlin, Java, Jetpack Compose, Kotlin Multiplatform, scalable architecture, mobile security, and high-performance app development.