Securing sites on a server you manage.
WITH A CONTROL PANEL
AutoSSL or an equivalent handles issue and renewal automatically, exactly as on shared hosting. This is the simplest route.
WITHOUT A CONTROL PANEL
Use an ACME client, which obtains free certificates from a certificate authority and installs them.
The client validates domain control, obtains the certificate, configures the web server, and sets up automatic renewal.
THE STEPS
- Install the ACME client.
- Ensure the domain resolves to the server and port 80 is reachable, since validation uses it.
- Run the client, specifying the domains.
- Confirm it configured the web server and set up renewal.
RENEWAL
Automatic renewal is configured by the client, usually via a timer or cron job. Verify it is in place and test that it works.
A certificate that expires because renewal was never actually configured is a common and avoidable failure.
WILDCARDS
Require DNS validation, which means the client needs API access to your DNS provider.
MONITORING
Set up external monitoring of certificate expiry, independent of the renewal mechanism.
