# Securing an unmanaged server with a Let's Encrypt SSL certificate

> Install Certbot on a server you manage yourself and use it to get and auto-renew a free Let's Encrypt certificate.

Source: https://helpcenter.ruachost.com/ssl-security/ssl-certificates/securing-an-unmanaged-server-with-a-lets-encrypt-ssl-certificate/

**Let’s Encrypt** provides free, automated SSL/TLS certificates that help secure websites with HTTPS. On unmanaged servers (where you control the OS and configuration directly), you can install Let’s Encrypt certificates using command‑line tools such as **Certbot**.

## Why Use Let’s Encrypt?

- Free and widely trusted by browsers.
- Automates certificate issuance and renewal.
- Provides strong encryption for websites and applications.
- Helps avoid “Not Secure” browser warnings.

## Steps to Secure an Unmanaged Server

### 1. Install Certbot

Certbot is the recommended client for Let’s Encrypt.

- On **Ubuntu/Debian**:

  ```bash
  sudo apt update
  sudo apt install certbot
  ```
- On **CentOS/RHEL**:

  ```bash
  sudo yum install certbot
  ```

⚠️ Note: Some VPS infrastructures may not support `snapd`. In that case, use your distribution’s package manager instead of Snap.

### 2. Generate and Install the SSL Certificate

Run Certbot with your web server type:

- **Apache**:

  ```
  sudo certbot --apache
  ```
- **Nginx**:

  ```
  sudo certbot --nginx
  ```

 Certbot will automatically configure your server to use HTTPS.

### 3. Automatic Renewal

Let’s Encrypt certificates are valid for **90 days**. Certbot sets up a cron job or systemd timer to renew them automatically:

```bash
sudo certbot renew --dry-run
```

```
```

This command tests the renewal process to ensure it works correctly.

### 4. Verify Installation

- Visit your site with `https://` and check for the padlock icon.
- Use SSL testing tools (e.g., SSL Labs) to confirm proper installation.

> **Note:**
- Ensure your domain points to the server before running Certbot.
- Open ports **80 (HTTP)** and **443 (HTTPS)** in your firewall.
- For advanced setups, Certbot supports DNS validation and wildcard certificates.