How Do I Install an SSL Certificate on a Vultr Compute Instance?

Securing your Vultr Compute instance with an SSL certificate enables encrypted HTTPS connections to your website or application, protecting your users' data and improving trustworthiness.

SSL Certificate Options

You can choose from three main types of SSL certificates:

• Let's Encrypt (Recommended): A free and automated certificate authority ideal for most use cases.
• Commercial Certificates: Paid certificates issued by commercial CAs, often required for advanced validation or enterprise use.
• Self-Signed Certificates: Suitable for internal or testing environments, but not trusted by browsers.

To help you decide, see How to Choose an SSL/TLS Certificate.

Setup Your Web Server

1. Deploy a Vultr Compute Instance running a supported OS (e.g., Ubuntu, CentOS, Debian).

2. Install a web server, such as Apache or Nginx.

3. Point your domain to your instance's IP address using an A record. You can set DNS records in your Vultr DNS or via your domain registrar.

   Example A record:

   Type: A
   Name: @
   Value: <Your Instance IP>
   TTL: 300

Install a Free Let's Encrypt SSL Certificate

Let’s Encrypt provides free certificates using the certbot utility, which automatically configures your web server for HTTPS.

1. Install Certbot.

   • For Ubuntu or Debian:

     CONSOLE

     Copy

     $ sudo apt update
     $ sudo apt install certbot python3-certbot-nginx  # For Nginx
     # or
     $ sudo apt install certbot python3-certbot-apache  # For Apache

     Explain Code

     Powered by Vultr AgentBeta

   • For CentOS, Rocky, or AlmaLinux:

     CONSOLE

     Copy

     sudo dnf install epel-release
     sudo dnf install certbot python3-certbot-nginx  # or python3-certbot-apache for httpd

     Explain Code

     Powered by Vultr AgentBeta

2. Run the below command to request and configure a SSL certificate.

   CONSOLE

   Copy

   $ sudo certbot --nginx
   # or
   $ sudo certbot --apache

   Explain Code

   Powered by Vultr AgentBeta

   Follow the on-screen prompts to:

   • Enter your domain name.
   • Select whether to redirect HTTP to HTTPS (recommended).

After completed, your site will be secured with SSL.

Renewing Certificates

Let’s Encrypt certificates expire every 90 days. Certbot installs a systemd timer or cron job to automatically renew them. You can verify renewal with:

$ sudo certbot renew --dry-run

Installing a Commercial or Self-Signed Certificate

1. Upload your .crt, .key, and CA bundle files to the server.

2. Edit your web server configuration to include:

   • For Nginx:

     INI

     Copy

     server {
     listen 443 ssl;
     server_name yourdomain.com;
     
     ssl_certificate /etc/ssl/certs/yourdomain.crt;
     ssl_certificate_key /etc/ssl/private/yourdomain.key;
     ssl_trusted_certificate /etc/ssl/certs/ca_bundle.crt;
     
     ...
     }

     Explain Code

     Powered by Vultr AgentBeta

   • For Apache (with SSL module enabled):

     INI

     Copy

     <VirtualHost *:443>
       ServerName yourdomain.com
     
       SSLEngine on
       SSLCertificateFile /etc/ssl/certs/yourdomain.crt
       SSLCertificateKeyFile /etc/ssl/private/yourdomain.key
       SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt
     
       ...
     </VirtualHost>

     Explain Code

     Powered by Vultr AgentBeta

3. Restart the web server.

$ sudo systemctl restart nginx    # For Nginx
$ sudo systemctl restart apache2  # For Apache

You have now successfully secured your Vultr Compute instance with an SSL certificate, ensuring encrypted and trusted communication for your users.