How to install an SSL certificate on a VPS

Learn how to install an SSL certificate on an OVHcloud VPS.

Securing your website is essential to protect your users' sensitive data and improve their trust. With an SSL certificate (Secure Sockets Layer), you can encrypt the exchanges between your visitors and your website, while strengthening its credibility. This guide documents the use of Let's Encrypt, a free and automated service.

Requirements

• A Virtual Private Server in your OVHcloud account
• Administrative access (sudo) via SSH to your server
• A functional website accessible in HTTP

Instructions

Summary

• Step 1 - Log in to your OVHcloud VPS
• Step 2 - Install Certbot
• Step 3 - Get an SSL certificate with Let's Encrypt
• Step 4 - Configure your web server
• Step 5 - Enable automatic renewal

Step 1 - Log in to your OVHcloud VPS

1. Download an SSH client like PuTTY or use your operating system's built-in terminal.
2. Log in to your OVHcloud VPS with the login information provided:

ssh root@<vps_ip>

Replace <vps_ip> with the IP address of your OVHcloud VPS.

Step 2 - Install Certbot

Certbot is a tool to automatically manage Let's Encrypt certificates. Follow the steps below to install Certbot according to your Linux distribution.

sudo apt update
sudo apt install certbot

sudo yum install epel-release
sudo yum install certbot

sudo dnf install certbot

Verify that Certbot is properly installed by running the following command:

certbot --version

This should show the version of Certbot installed.

Step 3 - Get an SSL certificate with Let's Encrypt

Automatic use with Certbot Nginx or Apache plugins (recommended)

Depending on your web server, use the corresponding command lines:

sudo apt install python3-certbot-nginx -y

sudo certbot --nginx -d your_domain

sudo apt install python3-certbot-apache -y

sudo certbot --apache -d your_domain

Certbot will automatically configure the SSL certificate and HTTPS redirection. Check that your website is accessible in HTTPS.

Standalone usage

If you prefer to configure your server manually, use Certbot in standalone mode. This mode uses a temporary server built into Certbot to validate your domain name and generate an SSL certificate.

Use the following command to request a certificate:

sudo certbot certonly --standalone -d your_domain

Replace your_domain with your domain name.

Once the certificate has been generated, the files are available in /etc/letsencrypt/live/your_domain/:

• fullchain.pem: the full certificate.
• privkey.pem: the private key.

Step 4 - Configure your web server

Example for Nginx

1. Open your website's configuration file (for example, /etc/nginx/sites-available/your_domain.conf).

2. Add the following lines to activate SSL:

   server {
       listen 443 ssl;
       server_name your_domain;
   
       ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;
   
       # Paramètres de sécurité supplémentaires
       ssl_protocols TLSv1.2 TLSv1.3;
       ssl_ciphers HIGH:!aNULL:!MD5;
   
       # Redirection HTTP vers HTTPS
       location / {
           try_files $uri $uri/ =404;
       }
   }

3. Add an automatic HTTP to HTTPS redirection:

   server {
       listen 80;
       server_name your_domain;
       return 301 https://$host$request_uri;
   }

4. Test and restart Nginx:

   sudo nginx -t
   sudo systemctl reload nginx

Check that your website is accessible in HTTPS.

Example for Apache

1. Enable SSL modules and headers:

   sudo a2enmod ssl
   sudo a2enmod headers

2. Modify your website's configuration (e.g. /etc/apache2/sites-available/your_domain.conf) to include:

   <VirtualHost *:80>
       ServerName your_domain
       DocumentRoot /var/www/your_domain
   
       Redirect permanent / https://your_domain/
   
       <Directory /var/www/your_domain>
           AllowOverride All
           Require all granted
       </Directory>
   
       ErrorLog ${APACHE_LOG_DIR}/ssltest_error.log
       CustomLog ${APACHE_LOG_DIR}/ssltest_access.log combined
   </VirtualHost>
   
   <VirtualHost *:443>
       ServerName your_domain
       DocumentRoot /var/www/your_domain
   
       # Activer SSL
       SSLEngine on
       SSLCertificateFile /etc/letsencrypt/live/your_domain/fullchain.pem
       SSLCertificateKeyFile /etc/letsencrypt/live/your_domain/privkey.pem
   
       # Paramètres de sécurité supplémentaires
       SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
       SSLCipherSuite HIGH:!aNULL:!MD5
       SSLHonorCipherOrder on
   
       <Directory /var/www/your_domain>
           AllowOverride All
           Require all granted
       </Directory>
   
       ErrorLog ${APACHE_LOG_DIR}/ssltest_error.log
       CustomLog ${APACHE_LOG_DIR}/ssltest_access.log combined
   </VirtualHost>

3. Test and restart Apache:

   sudo apachectl configtest
   sudo systemctl restart apache2

Check that your website is accessible in HTTPS.

Step 5 - Enable automatic renewal

Let's Encrypt certificates are valid for 90 days. Configure automatic renewal with Certbot:

Test automatic renewal:

sudo certbot renew --dry-run

Certbot automatically configures a cron task or a systemd timer to manage renewal. Check its status with:

sudo systemctl list-timers | grep certbot

Go further

Browse all the Virtual Private Servers guides.

Browse the rest of the OVHcloud US documentation for guides on our other products and services.

Learn more about VPS on the OVHcloud US website.