How to Install SSL Certificates Manually

6 min read

If you’re on a VPS without cPanel or Enhance, SSL isn’t automatic. You need to install and renew certificates yourself. This guide covers Certbot (Let’s Encrypt) for free certs and manual installation for commercial certs.

Before You Start link

SSL requires:

• A domain name pointing to your server (A record resolving to your server’s IP)
• Ports 80 and 443 open in your firewall
• Nginx or Apache installed and serving your site on port 80

If your DNS isn’t set up yet, Certbot will fail. Verify first:

  dig +short yourdomain.com
# Should return your server IP
  

Method 1: Certbot (Let’s Encrypt) link

Let’s Encrypt issues free SSL certificates. Certbot handles the entire process - obtaining, installing, and auto-renewing.

Install Certbot link

  sudo apt update
sudo apt install certbot -y

# Also install the plugin for your web server:
sudo apt install python3-certbot-nginx -y    # for Nginx
sudo apt install python3-certbot-apache -y   # for Apache
  

  sudo dnf install epel-release -y
sudo dnf install certbot -y

sudo dnf install python3-certbot-nginx -y    # for Nginx
sudo dnf install python3-certbot-apache -y   # for Apache
  

Get a Certificate with Nginx link

  sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
  

Certbot does everything:

1. Proves you own the domain (via a challenge on port 80)
2. Downloads the certificate
3. Configures Nginx to use it
4. Sets up HTTPS redirect

You’ll be asked for an email address (for account and policy notices) and to accept the terms.

Get a Certificate with Apache link

  sudo certbot --apache -d yourdomain.com -d www.yourdomain.com
  

Same flow - Certbot modifies your Apache VirtualHost automatically.

Standalone Mode (No Web Server Plugin) link

If you run something other than Nginx/Apache, or want full control:

  # Stop your web server temporarily
sudo systemctl stop nginx

# Get the certificate
sudo certbot certonly --standalone -d yourdomain.com -d www.yourdomain.com

# Start your web server again
sudo systemctl start nginx
  

The certificates land in /etc/letsencrypt/live/yourdomain.com/:

Wildcard Certificates link

Wildcard certs (*.yourdomain.com) require DNS validation:

  sudo certbot certonly --manual --preferred-challenges=dns -d "*.yourdomain.com" -d yourdomain.com
  

Certbot will ask you to create a TXT record at _acme-challenge.yourdomain.com. Add it in your DNS provider, wait a minute, then press Enter.

Auto-Renewal link

Certbot sets up auto-renewal by default. Verify it:

  # Test renewal (dry run - doesn't actually renew)
sudo certbot renew --dry-run

# Check the systemd timer
sudo systemctl status certbot.timer
  

If the timer isn’t active:

  sudo systemctl enable --now certbot.timer
  

Certificates renew when they have fewer than 30 days left. Let’s Encrypt stopped sending expiry warning emails in June 2025, so monitor expiry yourself, for example with an uptime monitor that checks SSL certificates.

Method 2: Commercial SSL Certificate link

If you bought an SSL certificate from a CA (DigiCert, Sectigo, GeoTrust, etc.), install it as follows.

Step 1: Generate a CSR link

  # Generate private key and CSR
openssl req -new -newkey rsa:2048 -nodes -keyout yourdomain.key -out yourdomain.csr
  

You’ll be prompted for details. The important field is Common Name (CN) - enter your domain (e.g., yourdomain.com).

  # View the CSR (copy this to your certificate provider)
cat yourdomain.csr
  

Submit the CSR to your certificate authority. They’ll send you the signed certificate files.

Step 2: Prepare the Certificate Files link

Your CA typically sends:

• yourdomain.crt - your certificate
• ca-bundle.crt or intermediate.crt - the CA’s chain

Combine them into a single file:

  cat yourdomain.crt ca-bundle.crt > fullchain.crt
  

Move everything to a secure location:

  sudo mkdir -p /etc/ssl/yourdomain.com
sudo mv fullchain.crt /etc/ssl/yourdomain.com/
sudo mv yourdomain.key /etc/ssl/yourdomain.com/
sudo chmod 600 /etc/ssl/yourdomain.com/yourdomain.key
  

Step 3: Configure Your Web Server link

  sudo nano /etc/nginx/sites-available/yourdomain.com
  

  server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$server_name$request_uri;
}

server {
    listen 443 ssl http2;    # on nginx 1.25.1+ (e.g. Debian 13) use "listen 443 ssl;" plus "http2 on;" to avoid a deprecation warning
    server_name yourdomain.com www.yourdomain.com;

    ssl_certificate     /etc/ssl/yourdomain.com/fullchain.crt;
    ssl_certificate_key /etc/ssl/yourdomain.com/yourdomain.key;

    # Strong SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    # HSTS (optional but recommended)
    add_header Strict-Transport-Security "max-age=63072000" always;

    root /var/www/yourdomain.com/public;
    index index.html;
}
  

  sudo nginx -t          # test config
sudo systemctl reload nginx
  

  sudo a2enmod ssl
sudo a2enmod headers
  

  sudo nano /etc/apache2/sites-available/yourdomain-ssl.conf
  

  <VirtualHost *:443>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    DocumentRoot /var/www/yourdomain.com/public

    SSLEngine on
    SSLCertificateFile    /etc/ssl/yourdomain.com/fullchain.crt
    SSLCertificateKeyFile /etc/ssl/yourdomain.com/yourdomain.key

    # Strong SSL settings
    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLHonorCipherOrder off

    Header always set Strict-Transport-Security "max-age=63072000"
</VirtualHost>

# HTTP to HTTPS redirect
<VirtualHost *:80>
    ServerName yourdomain.com
    ServerAlias www.yourdomain.com
    Redirect permanent / https://yourdomain.com/
</VirtualHost>
  

  sudo a2ensite yourdomain-ssl
sudo apachectl configtest
sudo systemctl reload apache2
  

Verify Your SSL Installation link

After installing, check that everything is correct:

  # Quick check from your server
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -dates

# Check certificate chain
openssl s_client -connect yourdomain.com:443 -servername yourdomain.com < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer

# From your local machine
curl -vI https://yourdomain.com 2>&1 | grep -E "expire|subject|issuer"
  

Or use SSL Labs for a detailed report and grade.

Troubleshooting link

Related Articles link

• SSL Certificates on Shared Hosting
• Secure Nginx and Apache
• How to Set Up a Firewall (UFW and CSF)
• Nginx Reverse Proxy