SSL certificates and installation

This guide is for your own VPS, where you manage the web server yourself. It shows how to get a free Let's Encrypt certificate with Certbot on Nginx or Apache, how to install a certificate you bought elsewhere, and how to make sure renewal never fails silently. If your site is on Domain India shared hosting, you don't need any of this: free SSL is issued from your control panel.

1. Which certificate do you need?

All of them encrypt traffic the same way. A free Let's Encrypt DV certificate is trusted by every current browser and is the right choice for most VPS sites. Domain India does not sell paid certificates; if you need an OV or EV certificate, buy it from a certificate authority and install it as shown in section 5.

2. Before you start

3. Install Certbot and get a certificate

On Ubuntu or Debian, the distribution packages are the simplest route:

sudo apt update
sudo apt install certbot python3-certbot-nginx     # Nginx
# or
sudo apt install certbot python3-certbot-apache    # Apache

Certbot's own site (certbot.eff.org) also documents a snap install and instructions for other distributions such as AlmaLinux and Rocky Linux.

Request and install the certificate in one step:

sudo certbot --nginx -d example.com -d www.example.com
# or
sudo certbot --apache -d example.com -d www.example.com

Certbot proves you control the domain, saves the files under /etc/letsencrypt/live/example.com/, edits your server config and can add an HTTP-to-HTTPS redirect. If you would rather edit the config yourself, use certbot certonly --webroot -w /var/www/example -d example.com and point your server at the files.

4. Renewal: automate it and test it

Let's Encrypt certificates are valid for 90 days. Certificate lifetimes across the industry are being shortened in stages under CA/Browser Forum rules, so manual renewal is no longer realistic.

The packaged Certbot installs a systemd timer (or cron job) that checks twice a day and renews certificates close to expiry. Confirm it works:

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

The web server must reload to pick up a renewed certificate. The Nginx and Apache plugins handle this; with certonly, add a deploy hook:

sudo certbot renew --deploy-hook "systemctl reload nginx"

Wildcard certificates

A wildcard needs a DNS-01 challenge: you prove control by publishing a TXT record at _acme-challenge.example.com. Certbot can do this automatically only with a DNS plugin for your DNS provider; with --manual you must add the record by hand at every renewal, which defeats automation.

5. Installing a certificate bought elsewhere

1. Create a private key and CSR on the server:

openssl req -new -newkey rsa:2048 -nodes \
  -keyout example.com.key -out example.com.csr \
  -subj "/CN=example.com"

2. Submit the CSR to the certificate authority and complete its validation.
3. Install the files. You receive the certificate and an intermediate chain (CA bundle). Keep the key readable only by root (chmod 600).

Nginx expects the certificate and chain in one file:

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate     /etc/ssl/example.com/fullchain.pem;  # certificate + intermediates
    ssl_certificate_key /etc/ssl/example.com/example.com.key;
    ssl_protocols TLSv1.2 TLSv1.3;
}

Apache 2.4.8 and later also accepts a full-chain file in SSLCertificateFile, with the key in SSLCertificateKeyFile. Test before reloading: sudo nginx -t or sudo apachectl configtest. Paid certificates need renewing too, before their expiry date; generating a fresh key and CSR for each renewal is good practice.

6. Check your installation

• External test: Qualys SSL Labs' SSL Server Test grades your configuration and flags a missing intermediate chain.
• From the command line: openssl s_client -connect example.com:443 -servername example.com shows the chain the server sends; curl -vI https://example.com shows the handshake.
• Mixed content: if the padlock is missing on some pages, images or scripts are still loading over http://.

7. Common problems

8. Where Domain India fits

Domain India VPS plans are self-managed: you get full root access and handle the web server, certificates and updates yourself. If you choose the free CyberPanel option at checkout, it has its own SSL tool. Prices are Domain India list prices on 19 September 2026, excluding 18% GST.

If you would rather not manage certificates at all, shared hosting and the App Platform include free SSL that is issued and renewed for you. New to your VPS? Start with How to access your VPS using SSH and the SSH security hardening checklist.

Ready to secure your server? Choose a VPS for full control, or pick cPanel hosting where free SSL is automatic. For help, open a support ticket.