How Do I Install an SSL Certificate on a Vultr Compute Instance?

Securing your Vultr Compute instance with an SSL certificate enables encrypted HTTPS connections to your website or application, protecting your users' data and improving trustworthiness.

SSL Certificate Options

You can choose from three main types of SSL certificates:

• Let's Encrypt (Recommended): A free and automated certificate authority ideal for most use cases.
• Commercial Certificates: Paid certificates issued by commercial CAs, often required for advanced validation or enterprise use.
• Self-Signed Certificates: Suitable for internal or testing environments, but not trusted by browsers.

To help you decide, see How to Choose an SSL/TLS Certificate.

Setup Your Web Server

1. Deploy a Vultr Compute Instance running a supported OS (e.g., Ubuntu, CentOS, Debian).

2. Install a web server, such as Apache or Nginx.

3. Point your domain to your instance's IP address using an A record. You can set DNS records in your Vultr DNS or via your domain registrar.

   Example A record:

   Type: A
   Name: @
   Value: <Your Instance IP>
   TTL: 300

Install a Free Let's Encrypt SSL Certificate

Let’s Encrypt provides free certificates using the certbot utility, which automatically configures your web server for HTTPS.

1. Install Certbot.

   • For Ubuntu or Debian:

     console Copy

     $ sudo apt update
     $ sudo apt install certbot python3-certbot-nginx  # For Nginx
     # or
     $ sudo apt install certbot python3-certbot-apache  # For Apache
     

     Explain Code

   • For CentOS, Rocky, or AlmaLinux:

     console Copy

     sudo dnf install epel-release
     sudo dnf install certbot python3-certbot-nginx  # or python3-certbot-apache for httpd
     

     Explain Code

2. Run the below command to request and configure a SSL certificate.

   console Copy

   $ sudo certbot --nginx
   # or
   $ sudo certbot --apache
   

   Explain Code

   Follow the on-screen prompts to:

   • Enter your domain name.
   • Select whether to redirect HTTP to HTTPS (recommended).

After completed, your site will be secured with SSL.

Renewing Certificates

Let’s Encrypt certificates expire every 90 days. Certbot installs a systemd timer or cron job to automatically renew them. You can verify renewal with:

$ sudo certbot renew --dry-run

Installing a Commercial or Self-Signed Certificate

1. Upload your .crt, .key, and CA bundle files to the server.

2. Edit your web server configuration to include:

   • For Nginx:

     ini Copy

     server {
     listen 443 ssl;
     server_name yourdomain.com;
     
     ssl_certificate /etc/ssl/certs/yourdomain.crt;
     ssl_certificate_key /etc/ssl/private/yourdomain.key;
     ssl_trusted_certificate /etc/ssl/certs/ca_bundle.crt;
     
     ...
     }
     

     Explain Code

   • For Apache (with SSL module enabled):

     ini Copy

     <VirtualHost *:443>
       ServerName yourdomain.com
     
       SSLEngine on
       SSLCertificateFile /etc/ssl/certs/yourdomain.crt
       SSLCertificateKeyFile /etc/ssl/private/yourdomain.key
       SSLCertificateChainFile /etc/ssl/certs/ca_bundle.crt
     
       ...
     </VirtualHost>
     

     Explain Code

3. Restart the web server.

$ sudo systemctl restart nginx    # For Nginx
$ sudo systemctl restart apache2  # For Apache

You have now successfully secured your Vultr Compute instance with an SSL certificate, ensuring encrypted and trusted communication for your users.