How to Set Up SSL/TLS on a Linux VPS with Nginx and Apache: Complete Guide

SSL/TLS is no longer optional — it is a baseline requirement for any website or web application. Modern browsers flag HTTP pages as "Not Secure", and Google factors HTTPS into its ranking algorithm. If you're running a SSD VPS and want to secure your traffic, this guide walks you through setting up free SSL/TLS with Let's Encrypt and Certbot — for both Nginx and Apache.

Why SSL/TLS Matters on a VPS

Without HTTPS, data transmitted between your server and visitors — passwords, form submissions, payment details — travels in plain text and can be intercepted. SSL/TLS encrypts this communication and provides:

Confidentiality — data is unreadable to third parties.
Integrity — content cannot be altered in transit.
Authenticity — visitors know they're communicating with your actual server.

Beyond security, HTTPS directly improves SEO. If you haven't chosen a hosting plan yet, check out CLIQHOST's NVMe VPS plans — high performance at a competitive price.

Prerequisites

Before you begin, make sure:

You have SSH access with root (or sudo) privileges.
Your domain (example.com) points to your VPS IP address via DNS.
Ports 80 and 443 are open in your firewall.
Nginx or Apache is already installed on your server.

If you haven't set up a web server yet, visit the CLIQHOST blog for step-by-step guides on installing Nginx and a full LEMP stack.

Step 1: Install Certbot

Certbot is the official Let's Encrypt client that automates certificate issuance and renewal.

Ubuntu / Debian

sudo apt update
sudo apt install certbot -y

For Nginx:

sudo apt install python3-certbot-nginx -y

For Apache:

sudo apt install python3-certbot-apache -y

CentOS / AlmaLinux / Rocky Linux

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -y
# or for Apache:
sudo dnf install certbot python3-certbot-apache -y

Step 2: Obtain an SSL Certificate — Nginx

If you're using Nginx, run the following command (replace example.com with your actual domain):

sudo certbot --nginx -d example.com -d www.example.com

Certbot will automatically:
1. Verify domain ownership via the HTTP-01 challenge.
2. Issue the certificate and private key.
3. Modify your Nginx server {} block to enable HTTPS.
4. Set up HTTP → HTTPS redirection.

Certificate files will be stored at:

/etc/letsencrypt/live/example.com/fullchain.pem
/etc/letsencrypt/live/example.com/privkey.pem

Verify the Nginx Configuration

sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtain an SSL Certificate — Apache

For Apache, the command is similar:

sudo certbot --apache -d example.com -d www.example.com

Certbot will enable the ssl and rewrite modules, create a supplementary config file, and configure automatic redirection. Verify and reload:

sudo apachectl configtest
sudo systemctl reload apache2

Step 4: Automatic Certificate Renewal

Let's Encrypt certificates expire after 90 days. Certbot installs a systemd timer (or cron job) that checks for renewal daily.

Check the timer status:

sudo systemctl status certbot.timer

Test the renewal process without actually issuing a new certificate:

sudo certbot renew --dry-run

A successful run outputs: Congratulations, all simulated renewals succeeded.

Step 5: Manual SSL Configuration (Without Certbot Plugin)

For standalone mode (Certbot temporarily runs its own server on port 80):

sudo certbot certonly --standalone -d example.com -d www.example.com

Then manually configure the SSL block in Nginx:

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    root /var/www/example.com;
    index index.html index.php;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Step 6: Test Your SSL Score

Once configured, test your SSL implementation at SSL Labs. A well-configured server should score at least A.

Factors that affect your score:
- Legacy protocols enabled (TLS 1.0, TLS 1.1) — disable them.
- Weak cipher suites — use only TLSv1.2 and TLSv1.3.
- Missing HSTS (HTTP Strict Transport Security).

Adding HSTS in Nginx:

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Step 7: Commercial SSL Certificates

Let's Encrypt is ideal for blogs and small projects. However, for e-commerce stores, financial platforms and enterprise applications, an OV (Organization Validated) or EV (Extended Validation) certificate provides an additional layer of trust.

At CLIQHOST you can purchase commercial SSL certificates from leading certificate authorities, with technical support included.

Common Mistakes and How to Avoid Them

Mistake	Solution
DNS not pointing to the VPS	Check A/AAAA records before running Certbot
Port 80 blocked in firewall	Run `sudo ufw allow 80` and `sudo ufw allow 443`
Certificate expired	Verify `certbot.timer` and enable auto-renewal
Mixed content (HTTP assets on HTTPS page)	Update URLs in CMS or use a migration plugin
Redirect loop	Remove duplicate redirects in both server config and CMS

SSL on a Managed VPS

If you'd rather not manage configurations manually, a managed NVMe VPS with included administration lets you delegate these tasks to the technical team. CLIQHOST's server management service covers SSL certificate installation and renewal, server hardening and continuous monitoring.

For projects that demand maximum reliability, our managed dedicated servers are also available with full SSL management included.

Conclusion

Setting up SSL/TLS on a Linux VPS with Certbot is a straightforward process that can be completed in 10–15 minutes. The time investment is minimal, but the payoff — stronger security, user trust and better SEO — is substantial.

Ready to get started? Explore CLIQHOST's SSD VPS and NVMe VPS plans for a solid, fast foundation. Have questions? Contact our team — we're here to help.

How to Set Up SSL/TLS on a Linux VPS with Nginx and Apache: Complete Guide