Defaults.Exposed › Setup › TLS

How to set up TLS with Let's Encrypt

Get a free, automatically renewing TLS certificate from Let's Encrypt and serve your website over modern, correctly configured HTTPS.

Why this matters to your business

TLS is the lock behind the padlock in a browser: it scrambles everything your visitors type — logins, card numbers, contact details — so strangers on the same network can’t read it. To offer TLS at all, your server needs a certificate, and for years certificates cost money and expired silently. Let’s Encrypt changed that: it is a non-profit certificate authority that issues certificates for free, through an automated protocol (ACME) that also renews them for you, so your padlock never quietly expires.

In plain terms: if your site has no HTTPS, browsers brand it “Not secure” and customers leave. If your certificate is manual, one missed renewal email takes your site down. Let’s Encrypt fixes both — free, and about thirty minutes of one-time setup.

Check what you actually need first

Many businesses already have this handled and don’t know it:

• Behind Cloudflare (orange cloud)? Cloudflare terminates TLS at its edge with its own certificates — visitors already see a valid padlock. You still want a certificate on your own server (“origin”) so the Cloudflare-to-server leg is encrypted too; Let’s Encrypt works for that, or use Cloudflare’s free Origin CA certificate instead.
• On a managed host or site builder (Squarespace, Wix, Shopify, most cPanel hosts)? These issue and renew certificates automatically — many of them literally use Let’s Encrypt under the hood (cPanel calls it AutoSSL). There is nothing to install; just confirm the padlock is present and “force HTTPS” is switched on.
• Running your own server (a VPS or dedicated box with Nginx, Apache, or similar)? This guide is for you — continue below.

Step-by-step with Certbot

Certbot is the official, most widely used Let’s Encrypt client. You need shell (SSH) access to your server, a domain whose DNS already points at that server, and port 80 open (Let’s Encrypt uses it to verify you control the domain).

1. Install Certbot. On most modern Linux distributions the recommended route is snap: sudo snap install --classic certbot then sudo ln -s /snap/bin/certbot /usr/bin/certbot. (On Debian/Ubuntu, sudo apt install certbot python3-certbot-nginx also works if you prefer apt.)
2. Run Certbot against your web server. For Nginx: sudo certbot --nginx For Apache: sudo certbot --apache Certbot reads your server config, lists your domains, and asks which ones to secure — pick your domain both with and without www if you serve both.
3. When prompted, choose to redirect HTTP to HTTPS. This is the setting that actually moves every visitor onto the encrypted connection.
4. That’s it for issuance: Certbot obtains the certificate, installs it into your server config, and reloads the server. Your site now serves HTTPS with a certificate trusted by every browser.
5. Confirm auto-renewal is armed: sudo certbot renew --dry-run Let’s Encrypt certificates last 90 days by design — short on purpose, because the renewal is automatic. The Certbot package installs a systemd timer (or cron job) that renews anything within 30 days of expiry; the dry run proves it works. You never touch it again.

Let’s Encrypt quirks people get wrong

• Don’t panic about the 90-day lifetime. It is not a limitation — it’s the design. The timer renews the certificate around day 60. If you find yourself renewing by hand every three months, the automation step above didn’t take; re-run the dry run and fix what it reports.
• Port 80 must be reachable for the default (HTTP-01) verification. If a firewall blocks port 80, issuance fails with a validation error. Open it — the HTTPS redirect means no visitor actually browses over it.
• A wildcard certificate (*.yourdomain.com) needs DNS verification. The DNS-01 challenge requires Certbot to place a TXT record, which only automates cleanly if your DNS provider has a supported API plugin. Most businesses don’t need a wildcard — listing your real hostnames is simpler and works with the default method.
• Mind the rate limits when testing. Let’s Encrypt limits how many certificates you can request per domain per week. While experimenting, add --test-cert (the staging environment) so failed attempts don’t burn your production quota; drop the flag for the real certificate.
• If you publish a CAA record, allow letsencrypt.org. A CAA record that lists only other authorities will make every Let’s Encrypt issuance and renewal fail — silently, weeks later, when the renewal comes due.
• The certificate is only half of your TLS grade. Our TLS checks grade the versions and ciphers your server accepts, not just the padlock. Certbot’s installer applies a modern, safe TLS configuration by default — but if your server config predates it, disable TLS 1.0/1.1 and weak ciphers too (the fix guide linked below covers it).

Verify it worked

Visit your site with https:// and check the padlock, then run the free check on this site. It will confirm in plain language that your certificate is valid and that only modern TLS versions and strong ciphers are accepted.

See the full fix guide →

Done? Check your domain free to confirm it worked — and see your full grade across all 34 checks.