HTTPS and TLS Certificate Renewal on a Linux VPS: Let's Encrypt, Auto-Renew and Expiry Alerts

The short answer

Every public website on a VPS needs a valid TLS certificate so browsers show the padlock and customers trust the page. Free certificates from Let's Encrypt are the usual choice, but they are short-lived on purpose, so the real job is not getting a certificate once. It is making sure renewal happens on its own, that you can prove it works, and that someone hears about it before a certificate expires. This guide walks through that setup on a Linux VPS in plain steps.

1. Know why certificates expire

Let's Encrypt certificates are valid for about 90 days today, and the industry is moving toward even shorter lifetimes. Short lifetimes limit the damage if a key leaks, but they also mean manual renewal is no longer realistic. Treat renewal as an automated background job, the same way you treat backups.

2. Pick the right tool for your web server

Certbot is the common choice for Nginx and Apache. Its web server plugins request the certificate and update the site config for you.
Caddy handles HTTPS automatically: point a domain at the server, name the site in the Caddyfile, and it requests and renews certificates on its own.
A reverse proxy in Docker (Traefik, Caddy or a similar proxy) can manage certificates for every container behind it. See Docker on a Linux VPS for that layout.

Use one tool per domain. Two tools fighting over the same certificate is a common cause of renewal failures.

3. Get the basics right before you request a certificate

The domain's DNS A (and AAAA, if you use IPv6) record points at the VPS.
Port 80 is open in the firewall if you use the standard HTTP check, and port 443 is open for HTTPS. Blocking port 80 after setup is a frequent reason renewals quietly stop working.
If you publish an AAAA record, the site must actually answer over IPv6, because the certificate authority may check that address.
For wildcard certificates, plan on the DNS check instead, which needs API access to your DNS provider.

4. Request the certificate

With Certbot and Nginx on Debian or Ubuntu, the typical flow is to install Certbot and its Nginx plugin from your distribution or the Certbot instructions, then run sudo certbot --nginx -d example.com -d www.example.com. Certbot proves you control the domain, installs the certificate, and can add a redirect from HTTP to HTTPS. Replace the example domains with your own.

5. Confirm automatic renewal is scheduled

Most Certbot packages install a systemd timer or cron job that tries renewal twice a day and only renews when a certificate is close to expiry. Check it with systemctl list-timers | grep certbot. If nothing is listed, look for a cron entry or add a schedule yourself.

6. Test renewal before you need it

Run sudo certbot renew --dry-run. It runs the whole renewal against a staging service without touching your live certificate. If it fails, fix it now: the usual causes are a closed port 80, a DNS record that moved, or a config change that broke the challenge path.

7. Reload the web server after renewal

A renewed certificate only goes live once the web server reloads it. The Certbot web server plugins handle this for you. If you use the standalone or webroot method, add a deploy hook such as --deploy-hook "systemctl reload nginx" so the new certificate is picked up without downtime.

8. Monitor expiry from outside the server

Let's Encrypt no longer sends expiry reminder emails, so you need your own check. Add certificate expiry to your uptime monitoring and alert when fewer than 14 days remain. For a quick manual check, run echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate. Our VPS monitoring and alerts guide covers how to route those alerts to the right person.

9. Harden the HTTPS setup

Redirect all HTTP traffic to HTTPS once the certificate works.
Allow only modern TLS versions (TLS 1.2 and 1.3).
Add a CAA record in DNS that names the certificate authority you use, so others cannot issue for your domain.
Turn on HSTS only after HTTPS has been stable for a while, and start with a short max-age.

10. Write the five-line runbook

Note which tool manages each domain, where the certificates live, how renewal is scheduled, how to run the dry run, and who gets the expiry alert. When something breaks months later, that note saves an hour of guesswork. Pair it with VPS backups and snapshots so the web server config and certificate settings can be restored too.

Quick checklist

DNS points at the VPS, ports 80 and 443 open
One certificate tool per domain
Renewal timer or cron confirmed
certbot renew --dry-run passes
Web server reloads after renewal
External expiry alert at 14 days
HTTP redirect, modern TLS, CAA record

Still setting up the server itself? Start with how to secure SSH on a Linux VPS and moving from shared hosting to a VPS.

Next steps

If you would rather not babysit certificates, renewals and alerts, our managed services can look after the server and its HTTPS setup for you. Read managed vs unmanaged VPS to compare, browse the plans, then tell us what you run or email sales@glasshosting.com.