Free SSL Setup: Let's Encrypt Step by Step
Free SSL certificate from Let's Encrypt — auto-renews. We cover installation with Certbot on Ubuntu and AlmaLinux.
How to Install a Free SSL Certificate from Let's Encrypt
Ten years ago, an SSL certificate cost hundreds of dollars annually. Today, Let's Encrypt makes it free, automated, and trusted by every major browser. This guide covers everything from what Let's Encrypt is to troubleshooting failed renewals.
What Is Let's Encrypt?
Let's Encrypt is a nonprofit Certificate Authority backed by organizations including Mozilla, the Electronic Frontier Foundation, and Akamai. It issues free, automated TLS/SSL certificates trusted by all modern browsers. Each certificate is valid for 90 days and renews automatically.
Over 300 million websites currently use Let's Encrypt — including government services and financial platforms.
Auto-Installation via cPanel
If your hosting is on كلاود or any modern cPanel provider, Let's Encrypt is built in through AutoSSL:
- Navigate to cPanel → "SSL/TLS Status"
- You will see a list of all your domains
- Select the domains to secure
- Click "Run AutoSSL"
AutoSSL performs Domain Validation automatically and installs the certificate. The entire process takes under two minutes. Your site immediately serves over HTTPS with a padlock icon in the browser.
Renewal happens automatically every 60 days, 30 days before expiration.
Manual Installation on a VPS with Certbot
On a VPS without cPanel, use Certbot:
Ubuntu/Debian:
sudo apt update
sudo apt install certbot python3-certbot-apache -y
sudo certbot --apache -d example.com -d www.example.com
For certificate-only issuance without automatic web server configuration:
sudo certbot certonly --webroot -w /var/www/html -d example.com
CentOS/AlmaLinux:
sudo dnf install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com
Certbot automatically modifies your Apache or Nginx configuration to enable HTTPS and adds an HTTP-to-HTTPS redirect.
Configuring Automatic Renewal
After installation, add a cron job for automatic renewal:
sudo crontab -e
Add this line:
0 3 * * * /usr/bin/certbot renew --quiet
This runs Certbot daily at 3 AM. When the certificate is within 30 days of expiration, it renews automatically.
To verify the renewal process works:
sudo certbot renew --dry-run
Troubleshooting Common Errors
"Challenge failed" error:
- Verify your domain DNS points to the correct server IP
- Confirm port 80 is open in your firewall (Let's Encrypt requires it for HTTP validation)
- After any DNS change, wait 10 to 15 minutes before retrying
"Too many certificates already issued": Let's Encrypt limits certificate issuance to 5 per domain per week. Reuse existing certificates rather than generating new ones each time.
Automatic renewal failing:
Check /var/log/letsencrypt/letsencrypt.log for the cause. Common reasons include firewall blocking port 80 and rate limit exhaustion.
When Do You Need a Paid SSL Certificate?
Let's Encrypt covers most use cases. Here is when to consider a paid certificate:
| Type | When Needed |
|---|---|
| DV (Domain Validation) | Standard websites — Let's Encrypt is sufficient |
| OV (Organization Validation) | Business sites that need company name visible in certificate details |
| EV (Extended Validation) | Banks and financial platforms — displays company name in the browser bar |
| Paid Wildcard | When complex subdomain structures require simplified management |
Note: Let's Encrypt now supports Wildcard certificates (*.example.com), but renewal requires DNS-based validation, which complicates full automation.
كلاود and SSL
كلاود activates SSL automatically on all shared hosting plans through AutoSSL. No manual setup is required on your part. Once DNS is configured, your site serves HTTPS within minutes.
On cloud servers (VPS), Certbot is available and full configuration documentation is in the knowledge base. The support team assists with automatic renewal setup during developer onboarding sessions.
A website without HTTPS in 2026 displays a red warning in Chrome, suffers SEO penalties, and gets rejected by government API endpoints that require encrypted connections. There is no reason to delay it.
Get Started
Want to try it yourself? Choose the right hosting plan or build your custom server with the specs you need.
