Free SSL Certificates with Let's Encrypt: The Complete Practical Guide

Why SSL Certificates Matter More Than Ever

If your website still serves pages over plain HTTP in 2024, you are actively losing visitors, trust, and search engine rankings. Google has used HTTPS as a ranking signal since 2014, and Chrome now labels every non-HTTPS site as “Not Secure” directly in the address bar.

The numbers tell a clear story:

• Over 95% of all web traffic loaded by Chrome is served over HTTPS (Google Transparency Report, 2024)
• Sites that migrate from HTTP to HTTPS see an average 5–10% uplift in organic traffic within 3 months
• 84% of online shoppers say they would abandon a purchase if data was sent over an insecure connection (GlobalSign survey)

The good news? Securing your site with a trusted SSL/TLS certificate no longer costs a penny, thanks to Let’s Encrypt.

What Is Let’s Encrypt?

Let’s Encrypt is a free, automated, and open Certificate Authority (CA) launched in April 2016 by the Internet Security Research Group (ISRG). It was created with one mission: to make encrypted connections the default across the entire web.

As of early 2024, Let’s Encrypt has issued certificates for over 360 million active websites, making it the largest CA in the world by volume.

Key Features at a Glance

Feature	Let’s Encrypt	Typical Paid DV Certificate
Cost	Free	$10–$80/year
Validation type	Domain Validated (DV)	Domain Validated (DV)
Encryption strength	256-bit (identical)	256-bit (identical)
Certificate lifetime	90 days (auto-renewable)	1 year
Wildcard support	Yes (via DNS-01 challenge)	Yes
Browser trust	All major browsers	All major browsers
Automation	Built-in via ACME protocol	Usually manual
Support	Community forums	Email/phone

As you can see, the encryption you get is exactly the same. The main difference is the certificate lifetime and the absence of OV/EV validation levels. For the vast majority of websites — blogs, portfolios, corporate sites, and even e-commerce stores — Let’s Encrypt is more than sufficient.

Prerequisites Before You Start

Before requesting your first certificate, make sure you have:

• A registered domain name pointing to your server’s IP address (A record or CNAME)
• Root or sudo access to your server (VPS, dedicated, or cloud instance)
• A web server installed — Apache or Nginx are the most common
• Port 80 open — Let’s Encrypt needs this for the HTTP-01 validation challenge
• Port 443 open — for serving HTTPS traffic after installation

If you are on shared hosting, many providers (like OVH, SiteGround, or A2 Hosting) now offer one-click Let’s Encrypt integration through their control panel. In that case, you can skip the command-line steps below.

Installing Certbot: The Official Let’s Encrypt Client

Certbot is the recommended tool for obtaining and managing Let’s Encrypt certificates. It is maintained by the Electronic Frontier Foundation (EFF) and supports virtually every Linux distribution.

Step 1: Install Certbot

On Ubuntu 22.04/24.04 with the snap package manager (recommended method):

# Remove any old OS-packaged Certbot to avoid conflicts
sudo apt remove certbot -y

# Install Certbot via snap
sudo snap install --classic certbot

# Create a symbolic link so you can run 'certbot' from anywhere
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Verify installation
certbot --version

On CentOS/RHEL 8+ or Amazon Linux 2023:

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -y

Step 2: Obtain and Install a Certificate

The process differs slightly depending on your web server.

For Nginx

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Certbot will:

1. Verify you own the domain by placing a temporary file on your server (HTTP-01 challenge)
2. Obtain the certificate from Let’s Encrypt
3. Automatically modify your Nginx configuration to enable HTTPS
4. Set up a redirect from HTTP to HTTPS (it will ask you)

For Apache

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

The process is identical — Certbot handles the Apache VirtualHost configuration for you.

Standalone Mode (No Web Server Plugin)

If you are running a non-standard web server (Node.js, Caddy, etc.), you can use standalone mode. Certbot temporarily spins up its own web server on port 80:

sudo certbot certonly --standalone -d yourdomain.com

Note: you must stop your existing web server while this runs, since Certbot needs to bind to port 80.

Step 3: Verify Your Certificate

After installation, confirm everything is working:

# Check certificate details
sudo certbot certificates

# Test HTTPS in the terminal
curl -I https://yourdomain.com

You should see a 200 OK response with headers indicating a secure connection. You can also use the excellent SSL Labs Server Test to get a detailed grade (aim for A or A+).

Setting Up Automatic Renewal

This is arguably the most critical step and the one most people overlook. Since Let’s Encrypt certificates expire every 90 days, failing to renew means your visitors will see a frightening browser warning — and your SEO will suffer immediately.

How Certbot Handles Renewal

If you installed Certbot via snap, a systemd timer is already configured. Verify it:

sudo systemctl list-timers | grep certbot

You should see something like:

snap.certbot.renew.timer   snap.certbot.renew.service

Certbot automatically runs twice a day and checks if any certificate is within 30 days of expiration. If so, it renews it.

Manual Cron Job (Fallback)

If the systemd timer is not present, add a cron job:

sudo crontab -e

Add this line:

0 3,15 * * * certbot renew --quiet --deploy-hook "systemctl reload nginx"

This runs at 3:00 AM and 3:00 PM every day. The --deploy-hook reloads Nginx only when a certificate is actually renewed.

Test the Renewal Process

Always do a dry run to make sure renewal will work when the time comes:

sudo certbot renew --dry-run

If this completes without errors, you are good to go.

Wildcard Certificates with Let’s Encrypt

Need to secure *.yourdomain.com? Let’s Encrypt supports wildcard certificates, but they require the DNS-01 challenge instead of HTTP-01. This means you must create a TXT record in your domain’s DNS.

sudo certbot certonly --manual --preferred-challenges dns \
  -d "*.yourdomain.com" -d yourdomain.com

Certbot will prompt you to create a DNS TXT record like:

_acme-challenge.yourdomain.com  →  "gHx7F9k2P..."

Once the record propagates (usually 1–5 minutes), press Enter and the certificate is issued.

For automated wildcard renewal, you will need a DNS plugin that can modify records programmatically. Certbot offers plugins for:

• Cloudflare (certbot-dns-cloudflare)
• Route 53 / AWS (certbot-dns-route53)
• Google Cloud DNS (certbot-dns-google)
• DigitalOcean (certbot-dns-digitalocean)
• OVH (certbot-dns-ovhcloud)

At Lueur Externe, our team regularly configures automated wildcard renewals on AWS infrastructure using the Route 53 plugin — it is one of the most reliable setups we have encountered across hundreds of client deployments as AWS Solutions Architect certified professionals.

Hardening Your SSL Configuration

Obtaining a certificate is only half the battle. A misconfigured TLS setup can still leave your site vulnerable. Here are the essential hardening steps.

Enforce Strong Protocols and Ciphers

Add this to your Nginx server block:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
ssl_prefer_server_ciphers on;

This disables the obsolete TLS 1.0 and 1.1 protocols, which are no longer considered secure.

Enable HSTS (HTTP Strict Transport Security)

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

HSTS tells browsers to always use HTTPS for your domain, even if the user types http://. The max-age of 63072000 seconds equals two years.

Enable OCSP Stapling

ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 1.1.1.1 valid=300s;
resolver_timeout 5s;

OCSP stapling improves TLS handshake performance by 30–100ms because the browser does not need to separately contact the CA to verify certificate revocation status.

Test Your Configuration

After applying these changes, run:

sudo nginx -t && sudo systemctl reload nginx

Then re-test on SSL Labs. With all of the above in place, you should achieve an A+ rating.

Common Pitfalls and Troubleshooting

Even though Certbot makes things straightforward, issues do arise. Here are the most frequent ones the Lueur Externe team encounters when auditing client servers:

1. Port 80 Blocked by Firewall

Symptom: Certbot fails with “Connection refused” during the HTTP-01 challenge.

Fix:

# UFW
sudo ufw allow 80/tcp

# firewalld
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --reload

# AWS Security Group
# Add inbound rule: TCP port 80 from 0.0.0.0/0

2. Too Many Requests (Rate Limits)

Let’s Encrypt enforces rate limits:

• 50 certificates per registered domain per week
• 5 duplicate certificates per week
• 300 new orders per account per 3 hours

If you hit a limit, wait and try again. Use --staging for testing to avoid rate limits:

sudo certbot --nginx --staging -d yourdomain.com

3. Mixed Content Warnings After Migration

After enabling HTTPS, your site may still load some resources (images, scripts, CSS) over HTTP. This triggers “mixed content” warnings.

Fix for WordPress:

• Install the “Really Simple SSL” plugin, or
• Run a search-and-replace on the database: http://yourdomain.com → https://yourdomain.com

Fix for PrestaShop:

• Go to Shop Parameters → General → Enable SSL / Enable SSL on all pages
• Update the PS_SSL_ENABLED and PS_SSL_ENABLED_EVERYWHERE values in the ps_configuration table

4. Renewal Fails Silently

Always monitor renewals. A simple approach is to add email notifications:

sudo certbot renew --quiet --deploy-hook "systemctl reload nginx" \
  || echo "Certbot renewal failed on $(hostname)" | mail -s "SSL ALERT" admin@yourdomain.com

For production-critical sites, we recommend integrating certificate monitoring into tools like UptimeRobot, Datadog, or a custom AWS CloudWatch alarm.

Let’s Encrypt vs. Paid SSL Certificates: When to Choose What

Let’s Encrypt is perfect for the majority of use cases, but there are scenarios where a paid certificate adds value:

• Extended Validation (EV): If your organization needs the verified company name displayed in certificate details (financial institutions, government sites). Note that modern browsers no longer show the green company name in the address bar, reducing the visual benefit of EV.
• Warranty/insurance: Some paid CAs offer financial warranties (e.g., $10,000–$1,750,000) in case of a mis-issuance. This is largely a marketing feature but may be required for compliance.
• Dedicated support: If you need 24/7 phone support for certificate issues, paid CAs offer this.

For 99% of small and medium businesses, Let’s Encrypt combined with proper Certbot automation provides enterprise-grade encryption at zero cost.

Integrating Let’s Encrypt with Cloud and CDN Services

If you serve your site through a CDN like Cloudflare or AWS CloudFront, the SSL setup works slightly differently.

Cloudflare

Cloudflare provides its own free SSL (“Universal SSL”) on their edge. However, you should still install a Let’s Encrypt certificate on your origin server and set Cloudflare’s SSL mode to Full (Strict) to ensure end-to-end encryption.

AWS CloudFront + ACM

AWS offers its own free certificates through AWS Certificate Manager (ACM). These are valid for 13 months, renew automatically, and integrate natively with CloudFront, ALB, and API Gateway. If your infrastructure is already on AWS, ACM is often the simpler choice for edge certificates, while Let’s Encrypt remains ideal for the origin EC2 instances.

Lueur Externe has been deploying these hybrid architectures — Let’s Encrypt on origin, ACM on the CDN — for clients since our early days working with AWS, and it remains one of the most robust and cost-effective patterns available.

Automating Certificate Management at Scale

If you manage dozens or hundreds of domains, manual Certbot commands do not scale. Consider these approaches:

• Certbot with configuration files: Create /etc/letsencrypt/cli.ini with default settings and use certbot certonly in scripted loops.
• acme.sh: A lightweight alternative to Certbot written in pure shell script, with built-in support for 60+ DNS providers.
• Traefik or Caddy: Modern reverse proxies that handle Let’s Encrypt certificate issuance and renewal natively with zero configuration.
• Kubernetes cert-manager: If you are running Kubernetes, cert-manager automates Let’s Encrypt certificates for Ingress resources.

# Example: cert-manager ClusterIssuer for Let's Encrypt
apiVersion: cert-manager.io/v1
kind: ClusterIssuer
metadata:
  name: letsencrypt-prod
spec:
  acme:
    server: https://acme-v02.api.letsencrypt.org/directory
    email: admin@yourdomain.com
    privateKeySecretRef:
      name: letsencrypt-prod-key
    solvers:
    - http01:
        ingress:
          class: nginx

Conclusion: Secure Your Site Today — There Is No Excuse Left

Let’s Encrypt has fundamentally changed the economics of web security. Free, automated, and universally trusted SSL certificates mean there is absolutely no reason for any website to remain on plain HTTP in 2024.

To recap the essential steps:

1. Install Certbot via snap or your package manager
2. Run a single command to obtain and install your certificate
3. Verify auto-renewal with certbot renew --dry-run
4. Harden your TLS configuration with strong ciphers, HSTS, and OCSP stapling
5. Monitor certificate expiration to catch any renewal failures

Whether you run a personal blog on a $5/month VPS or a high-traffic PrestaShop store on a multi-server AWS cluster, the process is accessible and the benefits are immediate: better security, improved SEO, and increased visitor trust.

If you would rather have experts handle your SSL setup, server hardening, and ongoing monitoring, the team at Lueur Externe has been doing exactly that since 2003 for businesses across France and beyond. As certified AWS Solutions Architects and PrestaShop experts, we ensure your hosting infrastructure is not just secure but optimized for performance and growth.

Get in touch with Lueur Externe for a free security audit of your current hosting setup. Let’s make sure your site is as secure as it should be.