Article 10.2 - Let's Encrypt SSL with Certbot
Short answerInstall certbot python3-certbot-nginx, run certbot --nginx for your domains, verify certbot.timer handles renewal.
Overview
Certbot obtains free TLS certificates when your domain A record points to the VPS and port 80 is reachable from the internet.
Before you begin
- Domain A record → VPS primary IP
- Nginx site block with
server_namematching domain - UFW allows 80 and 443
Obtain certificate
apt install certbot python3-certbot-nginx -y
certbot --nginx -d example.com -d www.example.com
certbot renew --dry-run
systemctl status certbot.timerManual renewal
certbot renew --force-renewalModern Debian/Ubuntu use certbot.timer for auto-renewal — no cron required.
Troubleshooting
| Error | Fix |
|---|---|
| DNS problem | Verify A record propagation |
| Connection refused port 80 | Open UFW 80; ensure Nginx listens on 80 |
| Renewal failed | Re-run dry-run; check firewall and server_name |
Frequently Asked Questions
Wildcard certificates?
DNS-01 challenge required — more complex than HTTP-01. Most single-VPS sites use certbot --nginx with apex + www.
Cert expired?
Run certbot renew and inspect /var/log/letsencrypt/ if timer failed.
Related Articles
Need More Help?
Search this knowledgebase for related guides. If the issue persists, open a ticket at billing.vpsgrid.net with your service ID, primary IP, and steps already tried. See What Information to Include in a Support Request and Security Responsibilities on Unmanaged VPS for scope and required details.
Was this answer helpful?
