Installing a free SSL certificate with Let's Encrypt

HTTPS is no longer a choice. Browsers mark HTTP pages as "not secure", Google treats HTTPS as a ranking signal, and most modern browser features refuse to work without it.

The good news: the certificate is free and installation takes five minutes.

If you use a control panel

On Plesk or cPanel, never touch the command line:

• Plesk: Install "SSL It!" from the extension catalogue, select the domain and issue the Let's Encrypt certificate. Renewal is automatic.
• cPanel: AutoSSL is on by default and issues certificates for hosted domains on its own. If it is not working, check WHM > Manage AutoSSL.

What follows is for servers without a panel.

Prerequisite: the domain must point at the server

Let's Encrypt verifies that the domain really resolves to your server before issuing. Check before you start:

bashdig +short yourdomain.com

The output should be your server's IP. If you changed DNS recently, wait for propagation; trying too early can hit Let's Encrypt rate limits.

Ports 80 and 443 must be open — validation happens over 80.

Installing with Certbot

bash# Ubuntu / Debian
apt install -y certbot python3-certbot-nginx

# AlmaLinux / Rocky
dnf install -y certbot python3-certbot-nginx

For Nginx, one command both obtains the certificate and edits the configuration:

bashcertbot --nginx -d yourdomain.com -d www.yourdomain.com

On Apache, install python3-certbot-apache and use --apache instead.

Certbot asks whether to redirect HTTP to HTTPS. Say yes — otherwise the site stays reachable on both, and search engines treat that as duplicate content.

Automatic renewal

Let's Encrypt certificates are valid for 90 days. Certbot installs a scheduled job that renews before expiry.

Confirm it works:

bashcertbot renew --dry-run
systemctl list-timers | grep certbot

Do not skip this. A certificate expiring silently is the most common reason a site greets you with a browser warning one morning.

After installation: mixed content

If the certificate is installed but the browser still shows no padlock, the cause is almost always mixed content: the page arrives over HTTPS while an image, script or stylesheet inside it is still requested over http://.

The browser console shows which resource is at fault. On WordPress you will need to bulk-update old URLs in the database — take a backup first.

Checklist

• https://yourdomain.com loads with a padlock
• http:// redirects to HTTPS with a 301
• The www and non-www versions share the same certificate
• certbot renew --dry-run completes without error
• No mixed content warnings in the browser console

If certificate installation or renewal gives you trouble, get in touch.