Free SSL setup command generator

This generator writes the commands for a free Let's Encrypt certificate that renews itself. Choose the web server, the ACME client and the validation method, and copy the numbered steps into a root shell on the server: install the client, add DNS credentials if needed, issue the certificate, wire it into Nginx or Apache, confirm automatic renewal and check the result with curl ssl.sh/your-domain. Everything runs in your browser.

If you cannot run commands on the server, for example on shared hosting or a CDN that only accepts uploads, use the free SSL certificate tool instead.

How to use it

1. Domain names: the names the certificate should cover, such as example.com www.example.com. Tick Include a wildcard for *.example.com; names it already covers are dropped.
2. Web server: Nginx, Apache, other or none, Caddy, or aaPanel / BT Panel. Caddy and BT Panel get certificates by themselves, so the generator shows their configuration or menu steps instead.
3. Operating system: Ubuntu/Debian or the RHEL family (Rocky, AlmaLinux, CentOS Stream). It changes package commands and the Apache service name (apache2 or httpd).
4. ACME client: Certbot or acme.sh (see the comparison below).
5. Validation: HTTP on port 80, or a DNS API with your provider's credentials. Wildcards always use DNS.
6. More options: key type (ECDSA P-256 by default, RSA 2048 for old clients), an optional email address and, for acme.sh, the Gitee mirror for servers in mainland China.

Certbot or acme.sh

Both are mature ACME clients that renew automatically; the main differences are installation and DNS provider support.

When you choose Certbot with a DNS provider it has no official plugin for, the generator switches to acme.sh and says so.

What the commands do

• Install: Certbot comes from snap, the method certbot.eff.org documents for current Linux distributions; DNS plugins need trust-plugin-with-root. acme.sh installs as root with its cron job, then switches its default CA to Let's Encrypt.
• Credentials: Certbot reads /root/.secrets/cloudflare.ini (mode 600) or the AWS credentials of root; acme.sh reads exported variables once and saves them in ~/.acme.sh/account.conf for renewals.
• Issue: Certbot's Nginx and Apache plugins validate over HTTP, install the certificate and add the HTTPS redirect in one command. In other cases the generator uses certonly with --webroot, --standalone or a DNS plugin, plus a --deploy-hook that reloads the server after each renewal.
• Install and configure: for acme.sh and for Certbot's certonly, the next block shows the ssl_certificate or SSLCertificateFile lines. Pair them with secure protocol and cipher settings from the TLS config generator.
• Renewal: the last commands only confirm the timer or cron job; certbot renew --dry-run tests a full renewal against the staging server.

Before you run them

• Every name must resolve to this server for HTTP validation, and port 80 must be open in the firewall and the cloud security group.
• In mainland China, a domain without ICP filing is usually blocked on port 80 by the cloud provider; use DNS validation.
• If the domain has CAA records, one of them must allow letsencrypt.org. Check with the CAA checker.
• Test on the staging server first if you are experimenting: add --test-cert to Certbot or --staging to acme.sh, so failed attempts do not count against the production rate limits.

Step-by-step guides with troubleshooting cover Nginx with Certbot, Apache with Certbot, acme.sh wildcards with a DNS API, Certbot with Cloudflare DNS, BT Panel and Caddy.