How to install a free Let's Encrypt SSL certificate on nginx and Apache

Let's Encrypt issues free 90-day SSL certificates trusted by every browser. Certbot automates issuance and renewal. This works on any Hostiger VPS or dedicated server running Ubuntu.

Prerequisites

A domain with an A record pointing to your server's IPv4
Port 80 open (needed for HTTP-01 challenge)
nginx or Apache already serving your domain on port 80

1. Install Certbot

# Ubuntu 22.04 / 24.04
apt update
apt install certbot python3-certbot-nginx -y   # for nginx
# apt install certbot python3-certbot-apache -y   # for Apache

2. Issue the certificate (nginx)

certbot --nginx -d example.com -d www.example.com \
  --agree-tos -m [email protected] --non-interactive --redirect

The --redirect flag automatically adds an HTTP → HTTPS 301 redirect to your nginx config.

2. Issue the certificate (Apache)

certbot --apache -d example.com -d www.example.com \
  --agree-tos -m [email protected] --non-interactive --redirect

3. Verify HTTPS is working

Open https://example.com. You should see the padlock icon. Test the config at SSL Labs — aim for A or A+.

4. Auto-renewal (already set up)

Certbot installs a systemd timer that runs twice a day. Verify:

systemctl list-timers | grep certbot
certbot renew --dry-run

If the dry-run passes, real renewals will succeed too. Certificates renew when 30 days remain.

5. Harden with HSTS

Add this to your nginx server block (inside the HTTPS server):

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

This forces browsers to always use HTTPS for a year. Only enable after HTTPS works reliably — HSTS is hard to reverse.

Common errors

"DNS problem: NXDOMAIN": your domain doesn't resolve. Check DNS with dig example.com.
"Timeout during connect": port 80 is firewalled. Open it: ufw allow 80/tcp.
"too many certificates already issued": Let's Encrypt has a 50 certs/week limit per registered domain. Wait, or use their staging environment for testing.

For a fully-managed HTTPS-first experience, Hostiger Web Hosting plans include free SSL that renews automatically with no CLI required.