# HTTPS setup guides: Nginx, Apache, ACME clients, cloud, panels

> Step-by-step HTTPS guides for Nginx, Apache, Caddy, IIS, Kubernetes, ACME clients, cloud load balancers and hosting panels, with copy-paste commands.

Source: https://ssl.sh/guides/
Last updated: 2026-11-10

Each guide sets up HTTPS with automatic renewal on one web server, ACME client, cloud service or hosting panel. A guide states the versions it applies to, lists the prerequisites (operating system, open ports, DNS records) and covers one step per section, with commands you can paste into a terminal.

Every guide finishes the same way. First you **verify** the deployment: the [SSL checker](https://ssl.sh/tools/ssl-checker/) shows the certificate chain, protocol versions and expiry date, and `curl ssl.sh/example.com` gives the same report in your terminal. Then you **automate renewal**, because manual renewal does not survive shrinking certificate lifetimes. Public certificates are capped at 200 days today and will be capped at 47 days from March 15, 2029; Let's Encrypt is moving its default certificates to 64 days in February 2027 and 45 days in February 2028. The renewal sections favour ACME Renewal Information (ARI, RFC 9773) where the client supports it, and a daily check where it does not.

The guides avoid outdated advice. Let's Encrypt shut down its OCSP service in 2025, so you will not find OCSP stapling settings for Let's Encrypt certificates here, and it stopped sending expiry reminder emails on June 4, 2025, so monitoring is your job. [ssl.sh monitoring](https://ssl.sh/monitor/) (in development) can watch your certificates for you.

If something fails along the way, each guide links to the matching page in the [error library](/errors/). For the background on how certificates, chains and ACME work, see [Learn](/learn/).