How to get free SSL for a custom domain
The padlock is free and automatic with Let's Encrypt. Here's how HTTPS certificates work and how to secure your custom domain at no cost.
There's no reason to run a site without HTTPS anymore. The padlock — a valid SSL/TLS certificate — is free, automatic, and takes one command to set up thanks to Let's Encrypt. Here's how it works and how to secure your custom domain at zero cost.
What SSL actually does
An SSL/TLS certificate does two things: it encrypts traffic between the visitor and your server (so nobody can snoop or tamper on the way), and it verifies that the domain is really served by whoever holds the certificate. The result is the padlock and https:// in the address bar — and modern browsers actively warn visitors away from sites without it.
Why it used to cost money — and doesn't now
Certificates were once a paid product you bought and manually installed each year. Let's Encrypt, a free non-profit certificate authority, changed that. It issues certificates for free, automatically, and they're trusted by every major browser. There's simply no need to pay for a standard certificate anymore.
The one trade-off: Let's Encrypt certificates last 90 days, not a year. But renewal is automated, so you never touch it after setup.
Prerequisites
Before you can get a certificate, one thing must be true: your domain has to point at your server. The certificate authority verifies you control the domain by checking it resolves to the server requesting the cert. So set your A record first:
Type: A
Name: @
Value: 203.0.113.10
TTL: 3600Confirm it resolves before continuing:
dig example.com +shortSetting it up with Certbot
Certbot is the standard tool that talks to Let's Encrypt, proves you own the domain, installs the certificate, and configures your web server. Install it and run it for your domain:
sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d example.com -d www.example.comCertbot will obtain the certificate, edit your Nginx config to use it, and offer to set up an automatic HTTP→HTTPS redirect (say yes). Within a minute your site is live over HTTPS.
For Apache, use python3-certbot-apache and --apache instead.
Automatic renewal
This is the part that makes it truly hands-off. Certbot installs a timer that renews certificates before they expire. Confirm it's working with a dry run:
sudo certbot renew --dry-runIf that succeeds, your certificate renews itself every 90 days forever — no reminders, no downtime, no cost.
Wildcard certificates
If you have many subdomains and don't want to list each one, Let's Encrypt can issue a wildcard certificate for *.example.com. Wildcards require a DNS-based challenge (adding a TXT record) rather than the simpler HTTP one:
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.comCertbot tells you the TXT record to add; once it verifies, you get a certificate covering every subdomain.
Verify it worked
Load your site and check for the padlock, or from the command line:
curl -I https://example.comA 200 (or a 301 redirect to HTTPS from the HTTP version) confirms you're secure.
The Nxeon angle
Nxeon includes free Let's Encrypt SSL, so securing a custom domain is part of the platform rather than an extra step or a bill. Point your domain at your server, enable the certificate, and your site gets the padlock — encrypted, trusted, and auto-renewing, at no cost.