What Is an SSL Certificate? How to Install Free Let's Encrypt
Last updated: 23 September 2026
An SSL/TLS certificate is a small file that encrypts the traffic between the browser and the server and verifies your site's identity. The https:// and the padlock icon in the address bar appear because of it. Today SSL is not a luxury but a requirement: browsers mark HTTP sites as "Not secure" and Google uses HTTPS as a ranking signal.
What SSL does and does not do
It does
- Encryption: a person in the middle (public Wi-Fi, ISP, attacker) cannot read passwords, card details or form data.
- Integrity: traffic cannot be altered in transit (ad injection, code insertion are prevented).
- Identity: at minimum, a guarantee that "the owner of this domain obtained this certificate".
It does not
- Protect your site from being hacked — SSL is the transport layer, application security is separate.
- Make a malicious site "good" — the padlock means "encrypted", not "trustworthy company".
Validation levels
| Type | Validates | Time | Use |
|---|---|---|---|
| DV (Domain Validation) | Domain control | Minutes | Blog, brochure, most sites — Let's Encrypt is this type |
| OV (Organization Validation) | Domain + the company's existence | 1–3 days | Corporate sites |
| EV (Extended Validation) | Domain + detailed company audit | 1–2 weeks | Banks, large e-commerce (the visual difference is now minimal) |
The encryption strength is the same in all three types. OV/EV only carry more corporate information in the certificate detail. DV is enough for most sites.
Free or paid?
Let's Encrypt issues free, auto-renewing DV certificates that are valid in all browsers. You need a paid certificate when:
- You want OV/EV corporate validation
- A warranty/insurance and commercial support are required
- A scenario Let's Encrypt does not support (certain client certificates, a need for a very long lifetime)
Wildcard and SAN
- Wildcard (
*.yoursite.com): covers all subdomains with a single certificate. Requires DNS-01 validation with Let's Encrypt. - SAN / multi-domain: multiple different domains in one certificate (
yoursite.com,yoursite.net,othersite.com).
Let's Encrypt setup (Nginx + certbot)
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d yoursite.com -d www.yoursite.comcertbot: obtains the certificate, adds it to the Nginx config, sets up an HTTP→HTTPS redirect.
Auto-renewal
Let's Encrypt certificates are valid for 90 days. The setup adds a systemd timer; to check:
systemctl status certbot.timer
sudo certbot renew --dry-runFor a wildcard
sudo certbot certonly --manual --preferred-challenges dns -d "*.yoursite.com" -d yoursite.comAdd the requested TXT record to DNS, wait for it to propagate, then continue. If your DNS provider has an API, the certbot-dns-* plugin fully automates it.
For Apache
sudo apt install certbot python3-certbot-apache -y
sudo certbot --apache -d yoursite.com -d www.yoursite.comVerify the setup
- Is the padlock icon shown in the browser + is
https://enforced? curl -I http://yoursite.com→ does it redirect to HTTPS with a301?- An A/A+ grade with SSL Labs (ssllabs.com/ssltest) or
testssl.sh. - HSTS header:
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
Common problems
- "Mixed content" warning: the page is HTTPS but an image/script inside it is loaded over
http://. Make all internal linkshttps://or protocol-relative (//). - certbot "too many requests": you hit Let's Encrypt's weekly limit; test with
--dry-runand try again a few hours later. - Certificate did not renew, site shows a warning:
certbot.timeris not running or port 80 is closed to certbot validation.sudo certbot renew --force-renewal. - Using Cloudflare: in Cloudflare's "Full (strict)" mode the origin server also needs a valid certificate — install Let's Encrypt or a Cloudflare Origin Certificate.
At Arcnar: On Web Hosting plans (coming soon) Let's Encrypt SSL is installed and renewed automatically. On a Compute plan, the certbot steps in this guide apply directly; if your domain is at Arcnar, DNS validation is done quickly from the panel.
Frequently asked questions
Is a free Let's Encrypt certificate as secure as a paid one?
In terms of encryption strength it is exactly the same and it is valid in all browsers. The difference is in the validation level: Let's Encrypt only does domain validation (DV). Paid OV/EV certificates carry extra corporate information in the certificate detail but do not strengthen the encryption.
Why does a Let's Encrypt certificate renew every 90 days?
A short lifetime narrows the misuse window of a stolen certificate and encourages automation. The certbot setup adds a systemd timer; certificates renew automatically before they expire. You can test with `sudo certbot renew --dry-run`.
I use Cloudflare — do I still need SSL on the server?
Yes. If you use Cloudflare in "Full (strict)" mode, the origin server also needs a valid certificate — Let's Encrypt or a free Cloudflare Origin Certificate. "Flexible" mode leaves the visitor-to-server leg unencrypted and is not recommended.
My site is HTTPS but the browser still says "not secure", why?
Usually "mixed content": the page loads over HTTPS but an image, CSS or script inside it is loaded over http://. Make all internal resource links https:// or protocol-relative (//).