A SMALL GUIDE TO A SAFER WEB
Make HTTPS
the starting point.
Put a proper lock on your site.
Get a free SSL certificate with Certbot or acme.sh — from the first command to automatic renewal, every step spelled out.
No sign-up · Runs on your server · Your private key stays yours
HTTPS setup, illustrated
01 / CHOOSE YOUR TOOL
Pick the tool that fits.
Both get you a free certificate — the difference is how you like to manage a server.
02 / MAKE IT HTTPS
Three steps to HTTPS.
Certbot as the example: issue, deploy and renew in one pass.
Before you start: the domain's A / AAAA records already point at this server, Nginx is bound to that domain and reachable over HTTP, and public TCP ports 80 / 443 are open. Run the commands below on the server, replacing example.com with your own domain.
Install Certbot
Your server needs snapd with support for classic snaps. If another version of Certbot is already installed, remove it first following the official instructions.
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbotIf that path already exists, check which version it points to first. On a different system? Pick your OS and web server ↗
Request a certificate and let the Nginx plugin deploy it
Follow the prompts to enter your email and accept the terms. The plugin validates the domain, requests the certificate and edits your Nginx config to enable HTTPS.
sudo certbot --nginx -d example.comNeed to cover www as well? Append -d www.example.com, and make sure that name also resolves and is bound correctly.
Test renewal and confirm the site loads
The snap install sets up an automatic renewal job. Do a renewal dry run first, then open your HTTPS site to confirm the result.
sudo certbot renew --dry-run
curl -I https://example.comConfirm the dry run succeeds, and keep an eye on renewal logs and alerts. Port 80, needed for HTTP validation, should stay reachable.
Install acme.sh and choose a certificate authority
This example runs in a root shell so it can write to Nginx's certificate directory. You need curl, cron and OpenSSL installed — and replace the email address.
curl https://get.acme.sh | sh -s email=you@example.com
~/.acme.sh/acme.sh --set-default-ca --server letsencryptThis picks Let's Encrypt explicitly. For other install methods and permission setups, see the official install notes ↗.
Validate the domain with webroot and request the certificate
Replace the path with your site's real web root, and make sure files under /.well-known/acme-challenge/ are reachable from the public internet.
~/.acme.sh/acme.sh --issue -d example.com \
-w /var/www/html --server letsencryptWildcard certificates need DNS validation. For automatic renewal a DNS API is recommended — see DNS provider setup ↗.
Install the certificate, configure HTTPS and the renewal reload
Use --install-cert to copy the certificate into a stable deployment directory and record the command to run after each renewal.
mkdir -p /etc/nginx/ssl/example.com
~/.acme.sh/acme.sh --install-cert -d example.com --ecc \
--key-file /etc/nginx/ssl/example.com/key.pem \
--fullchain-file /etc/nginx/ssl/example.com/fullchain.pem \
--reloadcmd "nginx -t && systemctl reload nginx"Then add the following TLS settings to that domain's Nginx server block, keeping your existing routes and the HTTP validation path.
listen 443 ssl;
ssl_certificate /etc/nginx/ssl/example.com/fullchain.pem;
ssl_certificate_key /etc/nginx/ssl/example.com/key.pem;
ssl_protocols TLSv1.2 TLSv1.3;Save the config, then test and reload Nginx. The installer creates a cron renewal job — confirm the cron service is running.
nginx -t && systemctl reload nginx
crontab -l
~/.acme.sh/acme.sh --info -d example.com --ecc
curl -I https://example.comLook for the acme.sh --cron entry in your crontab and keep checking the renewal logs. Certificate paths and the reload command must match your actual setup.
03 / A LITTLE MORE CLARITY
You might also be wondering.
Less jargon, more explanation.
The questions that come up before and after you request a certificate.
Does fastssl issue or store certificates for me?
fastssl is an independent guide. You run the tools on your own server, and a certificate authority such as Let's Encrypt does the issuing. This site offers no online request flow and never collects your private key.
Free or paid certificate — how do I choose?
Let's Encrypt issues free domain-validated (DV) certificates, which are fine for website HTTPS. Paid products may add organization validation, human support and similar services. Personal sites and most web applications can start with the domain-validated path.
Can I get a *.example.com wildcard certificate?
Yes, but it requires DNS-01 validation, so the HTTP validation commands on this page do not apply. Automate validation through the acme.sh DNS API or a Certbot DNS plugin. Note that *.example.com does not cover example.com, so you usually need to request both names.
Domain validation failed — where do I look first?
Check that the A and AAAA records both point to the right server, then confirm public TCP port 80 is reachable. Check the Nginx domain binding, and whether a CDN, reverse proxy or redirect is blocking the /.well-known/acme-challenge/ path. The tool's logs will also name the specific error.
Once automatic renewal is on, can I forget about it?
You still need the scheduled job to keep running, the validation method to keep working, and the web server to reload correctly after each renewal. Certbot has renew --dry-run for rehearsals; with acme.sh, check the cron job, the renewal logs and your reloadcmd. Setting up a separate certificate expiry alert is a good idea.