[{"data":1,"prerenderedAt":118},["ShallowReactive",2],{"seo-verification":3,"blog-certificats-ssl-lets-encrypt-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":20,"featuredImage":22,"bgImage":23,"posterImage":24,"relatedSolution":25,"intro":28,"sections":29,"ctaTitle":72,"ctaBody":73,"ctaButton":74,"ctaUrl":75,"relatedPosts":76},116,"certificats-ssl-lets-encrypt-vps","Free SSL Certificates with Let's Encrypt on a VPS","Deploy Let's Encrypt on your VPS: free HTTPS, automatic renewal, an A+ on SSL Labs with Nginx, Caddy or Traefik in Docker.",8,292,false,"2026-02-24T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[21],{"id":11,"name":16,"slug":17,"color":18,"icon":19},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fcertificats-ssl-lets-encrypt-vps-poster.svg",{"categorySlug":26,"appSlug":27},"securite","certbot","HTTPS is no longer optional: browsers, SEO and customers all demand it. On a VPS you control end to end, Let's Encrypt issues recognized certificates that are free and renew themselves. Here's how to build a clean, automated TLS chain rated A+, without depending on a shared hosting panel.",[30,34,44,47,69],{"type":31,"title":32,"body":33},"h2","Why manage Let's Encrypt yourself on a VPS","Let's Encrypt is a free certificate authority that issues TLS certificates validated by an automated challenge (HTTP-01 or DNS-01). On shared hosting, you are stuck with the provider's TLS config: imposed protocol versions, no OCSP stapling, opaque renewal. On a VPS, you own the `certbot` (or `acme.sh`), the reverse proxy and the TLS termination. You decide on the protocols (TLS 1.2\u002F1.3 only), the cipher suites, HSTS and OCSP stapling. You can also issue a **wildcard** certificate (`*.example.com`) via the DNS-01 challenge, cover several domains in a single certificate (SAN), and wire renewal to your own alerts. In short: total control over transport security, a prerequisite for an A+ score on SSL Labs and maximum browser-side trust.",{"type":35,"title":36,"items":37},"ul","What you gain by self-hosting the TLS chain",[38,39,40,41,42,43],"100% free certificates, valid for 90 days and renewed automatically without intervention.","Wildcard `*.example.com` possible via the DNS-01 challenge: a single certificate for all your subdomains.","Full control of the config: TLS 1.3, modern cipher suites, HSTS and OCSP stapling.","Multi-domain SAN certificates (`example.com`, `www.example.com`, `api.example.com`) on a single IP.","Scriptable and observable renewal: reload hooks, Slack\u002Femail alerts before expiry.","No dependency on a third-party panel: the same recipe works across all your VPSes and environments.",{"type":31,"title":45,"body":46},"Realistic prerequisites","TLS termination consumes very few resources: a VPS with **1 vCPU \u002F 512 MB to 1 GB of RAM** is more than enough to serve HTTPS for one or more sites. On the software side: `Docker` and `docker compose` (or a native Nginx\u002FCaddy), a **domain name pointing to the VPS's public IP** (a propagated A\u002FAAAA record), and **ports 80 and 443 open** in the firewall — port 80 is essential for the HTTP-01 challenge. For a wildcard certificate, plan for API access to your DNS provider (a token) to automate the DNS-01 challenge. Check propagation before starting: `dig +short example.com` must return the VPS's IP.",{"type":48,"title":49,"steps":50},"steps","Deploy automated HTTPS in a few steps",[51,54,57,60,63,66],{"title":52,"body":53},"Point the domain and open the ports","Create an A record `example.com` (and AAAA if IPv6) to the VPS's IP, then allow web traffic: `ufw allow 80,443\u002Ftcp`. Confirm resolution with `dig +short example.com` before going further — a challenge always fails if the DNS is not yet pointing.",{"title":55,"body":56},"Choose the reverse proxy that handles TLS","The simplest: `Caddy`, which obtains and renews Let's Encrypt automatically. A minimal `Caddyfile` — `example.com { reverse_proxy app:3000 }` — is enough to serve HTTPS as soon as `docker compose up -d`. For fine-grained control, go instead with `Nginx` + `certbot`, or `Traefik` with its built-in ACME resolver.",{"title":58,"body":59},"Issue the first certificate (HTTP-01)","With Nginx + Certbot in a container: `docker run --rm -v .\u002Fcerts:\u002Fetc\u002Fletsencrypt -v .\u002Fwebroot:\u002Fvar\u002Fwww certbot\u002Fcertbot certonly --webroot -w \u002Fvar\u002Fwww -d example.com -d www.example.com`. Certbot places a challenge file in the webroot served by Nginx, Let's Encrypt validates it, and deposits `fullchain.pem` + `privkey.pem`.",{"title":61,"body":62},"Issue a wildcard via DNS-01 (optional)","For `*.example.com`, the HTTP-01 challenge is unsuitable: use DNS-01. With `acme.sh` and an API token: `acme.sh --issue --dns dns_cf -d example.com -d '*.example.com'`. The script creates a `_acme-challenge` TXT record, waits for propagation, then cleans up automatically.",{"title":64,"body":65},"Harden the TLS config","In Nginx, force `ssl_protocols TLSv1.2 TLSv1.3;`, enable `ssl_stapling on;`, and add `add_header Strict-Transport-Security \"max-age=63072000; includeSubDomains; preload\" always;`. Redirect all of port 80 to 443. Reload without downtime: `nginx -s reload`.",{"title":67,"body":68},"Automate renewal","Schedule renewal twice a day with a proxy reload: `0 0,12 * * * docker run --rm -v .\u002Fcerts:\u002Fetc\u002Fletsencrypt certbot\u002Fcertbot renew --quiet --deploy-hook \"nginx -s reload\"`. Caddy and Traefik do it natively; check expiry with `echo | openssl s_client -connect example.com:443 2>\u002Fdev\u002Fnull | openssl x509 -noout -dates`.",{"type":70,"body":71},"tip","Before going to production, test against Let's Encrypt's **staging** environment (`--staging` with Certbot, `--server letsencrypt_test` with acme.sh): the production limit is 5 issuances per domain per week, and a poorly tuned script can quickly make you hit it. Also add **expiry monitoring**: a probe that runs `openssl x509 -checkend 604800` (7 days) and triggers an alert if automatic renewal has silently failed — a broken cron is the number one cause of an HTTPS certificate expiring in the middle of the night.","Deploy your Cloud VPS with HTTPS ready to go","The ServOrbit Cloud VPS template comes with Docker, a reverse proxy and the Let's Encrypt chain preconfigured: certificates issued and renewed automatically, an A+ SSL Labs score from the very first deployment. Focus on your application, not on TLS plumbing.","Deploy my Cloud VPS","\u002Fvps-cloud",[77,91,105],{"id":78,"slug":79,"title":80,"excerpt":81,"readTime":82,"views":83,"isPinned":13,"publishedAt":84,"category":85,"categories":86,"featuredImage":22,"bgImage":23,"posterImage":88,"relatedSolution":89},105,"superviser-vps-uptime-kuma","Monitoring your VPS with Uptime Kuma","Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.",6,1520,"2026-03-07T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[87],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fsuperviser-vps-uptime-kuma-poster.svg",{"categorySlug":26,"appSlug":90},"uptime-kuma",{"id":92,"slug":93,"title":94,"excerpt":95,"readTime":96,"views":97,"isPinned":13,"publishedAt":98,"category":99,"categories":100,"featuredImage":22,"bgImage":23,"posterImage":102,"relatedSolution":103},106,"monitoring-vps-grafana-prometheus","VPS Monitoring with Grafana and Prometheus","Set up a Grafana + Prometheus stack on your VPS to collect, store and visualize your system and application metrics.",9,522,"2026-03-06T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[101],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitoring-vps-grafana-prometheus-poster.svg",{"categorySlug":26,"appSlug":104},"grafana",{"id":106,"slug":107,"title":108,"excerpt":109,"readTime":82,"views":110,"isPinned":13,"publishedAt":111,"category":112,"categories":113,"featuredImage":22,"bgImage":23,"posterImage":115,"relatedSolution":116},107,"monitorer-vps-netdata","Monitor your VPS in real time with Netdata","Install Netdata on your VPS for per-second real-time monitoring: thousands of metrics, zero configuration, alerts included.",559,"2026-03-05T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[114],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fmonitorer-vps-netdata-poster.svg",{"categorySlug":26,"appSlug":117},"netdata",1785628422057]