Add an SSL Certificate

Getting the padlock and turning http:// into https://. It used to be a paid, fiddly chore. Today it's free and mostly one command — as long as DNS is already pointing correctly.

Do DNS first. Always.

SSL issuance verifies that you control the domain — usually by hitting your server over the domain name, or checking a DNS record. If the domain isn't pointing at your server yet, that check fails and the cert won't issue. Confirm dig +short thedomain.com returns your server IP before you run any cert command. If you haven't pointed it yet, do the Point a Domain to a VPS steps first.

What a certificate actually does

A certificate is a signed statement — "the server holding this key really is thedomain.com" — signed by an authority your browser already trusts. With it, the browser can (1) confirm it's talking to the real site and (2) encrypt everything in between. Curious how the trust and encryption work under the hood? That's the SSL / TLS page. This page is just the how-to.

Option A — the easy way: Let's Encrypt + certbot

On a normal Linux VPS running nginx or Apache, this is the whole thing:

# 1. Install certbot (Ubuntu/Debian example)
sudo apt update
sudo apt install certbot python3-certbot-nginx

# 2. Issue AND auto-configure the cert for nginx
sudo certbot --nginx -d thedomain.com -d www.thedomain.com

# Apache instead? swap the plugin:
sudo certbot --apache -d thedomain.com -d www.thedomain.com

Certbot talks to Let's Encrypt, proves you own the domain, downloads the certificate, edits your web server config to use it, and sets up an automatic http → https redirect. You'll be asked for an email (for expiry warnings) and to agree to the terms. Done.

Renewal is automatic — but verify it

Let's Encrypt certs last 90 days. Certbot installs a timer that renews them automatically. Confirm it's working with a dry run:

sudo certbot renew --dry-run

If that succeeds, you never have to think about renewals again.

Option B — Cloudflare does it for you

If the domain is proxied through Cloudflare (orange cloud), Cloudflare terminates SSL at its edge for free — visitors get HTTPS to Cloudflare automatically, no certbot needed. For the connection between Cloudflare and your server, set the SSL mode to Full (strict) and install a free Cloudflare Origin Certificate on the VPS so that leg is encrypted too.

Avoid the "redirect loop" trap

Cloudflare SSL mode set to Flexible + your server also redirecting to HTTPS = an infinite redirect loop (ERR_TOO_MANY_REDIRECTS). Fix: use Full (strict) mode with a real cert on the origin. Flexible is almost never what you want.

Subdomains and wildcards

A certificate covers exactly the names you list. Add every hostname that should be secure:

# Multiple specific names
sudo certbot --nginx -d thedomain.com -d www.thedomain.com -d app.thedomain.com

# A wildcard (needs DNS validation, not the nginx plugin)
sudo certbot certonly --manual --preferred-challenges dns \
  -d thedomain.com -d '*.thedomain.com'

Wildcards (*.thedomain.com) require the DNS challenge — certbot gives you a TXT record to add, checks it, then issues. Many DNS providers have a certbot plugin that adds the TXT record automatically.

For the support team — the usual SSL tickets

Symptom	Most likely cause	Fix
"Your connection is not private" / `NET::ERR_CERT_...`	Cert expired, or the domain name doesn't match the cert	Check expiry & names (below); reissue if needed
certbot fails with "challenge failed"	DNS not pointing at the server yet, or port 80 blocked	Verify `dig +short`; open port 80 in the firewall
`ERR_TOO_MANY_REDIRECTS`	Cloudflare "Flexible" SSL + server redirect loop	Switch Cloudflare to Full (strict)
Padlock shows but "mixed content" warning	Page loads some images/scripts over http://	Change those asset URLs to https:// (or protocol-relative)
Cert expired even though certbot is installed	Auto-renew timer not running	`certbot renew --dry-run`, fix the timer

Handy checks

# When does the cert expire, and what names does it cover?
echo | openssl s_client -connect thedomain.com:443 -servername thedomain.com 2>/dev/null \
  | openssl x509 -noout -subject -dates -ext subjectAltName

# List certs certbot manages on this box
sudo certbot certificates

# Force a renewal test
sudo certbot renew --dry-run

Key takeaways

Point DNS first — SSL verification depends on it.
On a Linux VPS: certbot --nginx -d yourdomain -d www.yourdomain does everything.
Certs are free (Let's Encrypt), last 90 days, and renew automatically — verify with a dry run.
Cloudflare can handle SSL for you; use Full (strict), never Flexible.
A cert only covers the names you list — remember subdomains.