SSL/TLS setup guides
Copy-paste instructions for getting a certificate, installing it, verifying the chain and keeping renewal fully automatic.
Each guide sets up HTTPS with automatic renewal on one web server, ACME client, cloud service or hosting panel. A guide states the versions it applies to, lists the prerequisites (operating system, open ports, DNS records) and covers one step per section, with commands you can paste into a terminal.
Every guide finishes the same way. First you verify the deployment: the SSL checker shows the certificate chain, protocol versions and expiry date, and curl ssl.sh/example.com gives the same report in your terminal. Then you automate renewal, because manual renewal does not survive shrinking certificate lifetimes. Public certificates are capped at 200 days today and will be capped at 47 days from March 15, 2029; Let's Encrypt is moving its default certificates to 64 days in February 2027 and 45 days in February 2028. The renewal sections favour ACME Renewal Information (ARI, RFC 9773) where the client supports it, and a daily check where it does not.
The guides avoid outdated advice. Let's Encrypt shut down its OCSP service in 2025, so you will not find OCSP stapling settings for Let's Encrypt certificates here, and it stopped sending expiry reminder emails on June 4, 2025, so monitoring is your job. ssl.sh monitoring (in development) can watch your certificates for you.
If something fails along the way, each guide links to the matching page in the error library. For the background on how certificates, chains and ACME work, see Learn.
Web servers
Nginx + Certbot
Install Certbot from snap, get a free Let's Encrypt certificate for Nginx, redirect HTTP to HTTPS and verify automatic renewal. Ubuntu and Debian.
Apache + Certbot
Get a free Let's Encrypt certificate for Apache httpd 2.4 with Certbot, configure the SSL virtual host, redirect HTTP to HTTPS and automate renewal.
Caddy automatic HTTPS
Install Caddy 2 from the official repository, serve HTTPS with automatic Let's Encrypt certificates, add DNS-01 for wildcards and check renewal.
HAProxy SSL termination
Terminate TLS in HAProxy with Let's Encrypt: combined PEM files, SNI certificate directory, ACME challenge routing, HTTPS redirect and reload on renewal.
Tomcat SSL
Configure HTTPS on Apache Tomcat 10.1/11 with PEM certificate files from Let's Encrypt, enable TLS 1.2+1.3, redirect HTTP and restart Tomcat on renewal.
Node.js HTTPS
Run a Node.js HTTPS server with Let's Encrypt: https.createServer options, HTTP redirect, ACME webroot, port 443 without root, reload on renewal.
Install intermediate certificate
Find the right intermediate certificate, build a correctly ordered full chain, install it on Nginx, Apache, IIS, HAProxy, Tomcat or Node.js.
Generate CSR with OpenSSL
Create a private key and CSR with one OpenSSL command, add subjectAltName entries, choose RSA 2048 or ECDSA P-256, and verify the request.
Redirect HTTP to HTTPS
Force HTTPS with one 301 or 308 redirect on Nginx, Apache, Caddy, IIS or a CDN, avoid loops behind proxies, keep ACME HTTP-01 renewals working.
Enable HSTS
Add the Strict-Transport-Security header step by step: short max-age first, then includeSubDomains and preload, without locking users out.
ACME clients and automation
acme.sh wildcard (DNS API)
Issue a Let's Encrypt wildcard certificate with acme.sh and a DNS API: install, set the default CA, issue via DNS-01, install with a reload command.
acme.sh + Alibaba Cloud/DNSPod
Issue a Let's Encrypt wildcard certificate with acme.sh via the Alibaba Cloud DNS, DNSPod or DNSPod.com API, install it on Nginx, auto-renew.
Certbot + Cloudflare DNS
Get a Let's Encrypt wildcard certificate with Certbot's Cloudflare DNS plugin: scoped API token, credentials file, DNS-01 issue, renewal with reload.
lego DNS-01
Use the lego v5 ACME client for Let's Encrypt wildcard certificates via DNS-01: install, lego run with a DNS provider, deploy hook, daily timer.
Certbot renewal hooks
Reload services after Certbot renews: --deploy-hook, --pre-hook, --post-hook, the renewal-hooks directories, RENEWED_LINEAGE and certbot reconfigure.
Automatic renewal
Set up and check automatic renewal for Certbot, acme.sh, lego, Caddy, Traefik, cert-manager and win-acme: schedules, ARI, hooks, monitoring.
Let's Encrypt profiles
Choose a Let's Encrypt profile (classic, 45-day tlsserver, 6-day shortlived) and set it in Certbot, acme.sh, lego, Caddy, Traefik or cert-manager.
Prepare for 47-day certificates
Get ready for 200-, 100- and 47-day certificate limits and Let's Encrypt's 64/45-day defaults: inventory, automation, ARI, DCV and monitoring.
Panels and NAS
BT Panel SSL
Get a free Let's Encrypt certificate in BT Panel (宝塔) or aaPanel by file or DNS verification, deploy your own, force HTTPS, keep renewal working.
1Panel SSL
In 1Panel v2, create ACME and DNS accounts, apply for a Let's Encrypt certificate (wildcards too), enable HTTPS with a redirect, and auto-renew.
cPanel SSL
Secure a cPanel site with free AutoSSL (Let's Encrypt) or a purchased certificate: check SSL/TLS Status, fix DCV problems, install a cert, force HTTPS.
Plesk SSL
Secure a Plesk Obsidian site with SSL It!: free Let's Encrypt certificate, wildcard via DNS, HTTP-to-HTTPS redirect, HSTS and auto renewal.
Synology NAS SSL
Get a trusted certificate for a Synology NAS: DSM built-in Let's Encrypt (port 80), synology.me DDNS, or acme.sh DNS-01 with the synology_dsm hook.
Cloud and CDN
Alibaba Cloud SSL
Get a certificate from Alibaba Cloud Certificate Management Service, validate it by DNS or file, install it on Nginx or deploy it to CDN and ALB.
Tencent Cloud SSL
Apply for Tencent Cloud's free TrustAsia DV certificate, validate by DNS or file, install the Nginx bundle on your server, or quick-deploy it to CDN.
Alibaba Cloud CDN HTTPS
Turn on HTTPS for an Alibaba Cloud CDN domain: pick a certificate, force HTTPS, set HSTS and TLS versions, and choose the origin protocol policy.
Tencent Cloud CDN HTTPS
Configure HTTPS on Tencent Cloud CDN: hosted or own certificate, origin-pull protocol, forced redirection, HSTS, TLS versions and HTTP/2.
AWS ACM + ALB
Request a free ACM certificate with DNS validation, attach it to an ALB HTTPS listener with a TLS 1.3 policy, redirect HTTP, keep managed renewal working.
Cloudflare Origin CA
Create a free Cloudflare Origin CA certificate, install it on Nginx, switch SSL mode to Full (strict) and optionally use Authenticated Origin Pulls.
Azure App Service SSL
Secure an Azure App Service custom domain with the free managed certificate or your own PFX, bind it with SNI, enforce HTTPS Only and TLS 1.2.
Google Cloud LB SSL
Add HTTPS to a Google Cloud Application Load Balancer with Google-managed certificates or Certificate Manager, redirect HTTP, track status.
Containers and platforms
Docker Nginx + Certbot
Run Nginx and the official certbot/certbot image with Docker Compose: shared volumes, first issuance, HTTPS config and a host renewal timer.
Traefik + Let's Encrypt
Configure Traefik v3 to get Let's Encrypt certificates automatically: certificate resolver, acme.json, Docker labels, HTTPS redirect, wildcards.
cert-manager
Install cert-manager with Helm, create Let's Encrypt staging and production ClusterIssuers, issue certificates for an Ingress or Gateway and debug orders.
WeChat Mini Program HTTPS
Make a WeChat Mini Program reach your API: ICP-filed domain, trusted certificate with full chain, TLS 1.2+, server domains, handshake fixes.
Vercel custom domain SSL
How Vercel issues Let's Encrypt certificates for custom domains: apex A vs www CNAME records, CAA values, wildcards, Enterprise uploads and errors.
Netlify custom domain HTTPS
Set up HTTPS for a Netlify custom domain: the 75.2.60.5 and CNAME records, Let's Encrypt CAA values, wildcards, custom certificates and error fixes.
GitHub Pages HTTPS
Enable HTTPS on a GitHub Pages custom domain: the four A and AAAA records, www CNAME, letsencrypt.org CAA, Enforce HTTPS and certificate errors.
Cloudflare Pages custom domain
Cloudflare Pages custom domains with HTTPS: apex vs subdomain DNS, the CAA records Cloudflare needs, and how to fix a domain stuck on Verifying.
Render custom domain TLS
Add a custom domain to a Render service with managed TLS: apex vs www records, CAA for letsencrypt.org and pki.goog, wildcard CNAMEs and fixes.
Firebase Hosting custom domain SSL
Connect a custom domain to Firebase Hosting: TXT and A records, CAA for letsencrypt.org and pki.goog, and fixes for Needs setup and Pending.
Fly.io custom domain certificate
Add a custom domain to a Fly.io app with fly certs add: A/AAAA vs CNAME, DNS-01 wildcards, CAA, imported certificates and stuck validation.
Heroku ACM
Set up Heroku ACM for custom domains: herokudns.com DNS targets, CAA for Let's Encrypt, ACM statuses, failure reasons and fixes.
AWS Amplify custom domain SSL
Connect a custom domain to AWS Amplify with a managed or imported ACM certificate: DNS records, Amazon CAA values, wildcards and fixes.
Railway custom domain
Add a custom domain to Railway with automatic Let's Encrypt SSL: CNAME and TXT records, root domains, wildcards, CAA and stuck validation.
Mail servers
Windows
IIS SSL certificate
Install an SSL certificate on IIS 10: CSR or PFX import, HTTPS binding with SNI, intermediate certificate, HTTP-to-HTTPS redirect and renewal.
win-acme
Use win-acme (wacs.exe) to get Let's Encrypt certificates for IIS: interactive and unattended setup, bindings, scheduled renewal, ARI, DNS validation.
Website builders and hosting
Shopify SSL
How Shopify issues free SSL certificates for custom domains, which DNS and CAA records it needs, and how to fix SSL pending or SSL unavailable.
Squarespace SSL
How Squarespace issues free Let's Encrypt SSL, the DNS and CAA records a domain needs, and how to fix SSL Certificates Unavailable.
Wix SSL
How Wix issues SSL automatically, the A and CNAME records for pointing a domain, why CAA and DNSSEC break it, and how to fix a not secure site.
Webflow SSL
How Webflow issues SSL via Let's Encrypt and Google Trust Services, the DNS and CAA records it needs, and how to fix domain errors and 525s.
WordPress.com HTTPS
How WordPress.com issues free Let's Encrypt SSL, how to point a domain, which CAA value to allow, and how to fix SSL certificate pending.
GoDaddy SSL
Free SSL on GoDaddy cPanel (AutoSSL), Managed WordPress and Websites + Marketing: DNS, CAA, stuck certificates, HTTPS redirects, custom certs.
Hostinger SSL
How Hostinger's free Lifetime SSL installs, what to do about CAA records, how to fix Failed or Installing status, force HTTPS and import an SSL.
SiteGround SSL
SiteGround's free Let's Encrypt SSL: pointing a domain, the CAA value, SSL Manager errors, HTTPS Enforce, insecure content and imported certs.
Bluehost SSL
How Bluehost's free Let's Encrypt SSL works via AutoSSL, which CAA value to allow, how to fix a Not secure status and how to force HTTPS.
Namecheap hosting SSL
Free SSL on Namecheap shared hosting: nameservers, CAA for SSL.com and Sectigo, fixing In progress in the Namecheap SSL plugin, HTTPS redirects.
FAQ
Which guide should I start with?
Start with the guide for the software that terminates TLS for your site: the web server, reverse proxy, load balancer or hosting panel that listens on port 443. If a CDN or cloud load balancer sits in front, configure HTTPS there first and then secure the origin.
Do these guides still work as certificate lifetimes get shorter?
Yes. Every guide ends with an automatic renewal section, because public TLS certificates are limited to 200 days from March 15, 2026, 100 days from March 15, 2027 and 47 days from March 15, 2029. Let's Encrypt's default certificates drop from 90 to 64 days on February 10, 2027. Anything renewed by hand will break.
Have these steps been tested?
Each guide is checked against the official documentation on the date shown at the top. When a guide has been run end to end on a real server, the tested environment (OS, server and client versions) is listed on the page.