This section provides a step-by-step guide to installing a free Let's Encrypt TLS certificate, focusing on common hosting environments used by NZ businesses. We'll assume you have SSH access to your server or a cPanel/Plesk interface.
Step 1: Pre-requisites & Domain DNS Check
Before you begin, ensure:
- Your domain's DNS records (A/AAAA records) point correctly to your web server's IP address. Use a tool like
dnschecker.org to verify global propagation, especially important if you've recently changed hosts (e.g., from a shared host in Australia to a local NZ VPS).
- You have SSH access to your server (for Linux-based hosts like AWS EC2, DigitalOcean, Vultr NZ) OR access to your cPanel/Plesk control panel.
- Your server's firewall allows incoming HTTP (port 80) and HTTPS (port 443) traffic.
Step 2: Install Certbot (For SSH/Linux Servers)
Certbot is a free, open-source software tool that automates the process of obtaining and renewing Let's Encrypt certificates. The installation varies slightly by operating system:
- Ubuntu/Debian:
sudo apt update && sudo apt install certbot python3-certbot-apache (for Apache) or sudo apt install certbot python3-certbot-nginx (for Nginx).
- CentOS/RHEL:
sudo yum install epel-release && sudo yum install certbot python3-certbot-apache (for Apache) or sudo yum install certbot python3-certbot-nginx (for Nginx).
If you're using cPanel/Plesk, skip this step. Most modern cPanel/Plesk installations have built-in Let's Encrypt integration, often under a section like 'SSL/TLS Status' or 'Let's Encrypt SSL/TLS'.
Step 3: Obtain and Install the Certificate
A. For Apache/Nginx (via SSH/Certbot):
Run the appropriate command for your web server. Certbot will guide you through the process, detect your server configuration, and automatically modify it.
- Apache:
sudo certbot --apache
- Nginx:
sudo certbot --nginx
Certbot will ask for your domain name(s) (e.g., yourdomain.co.nz and www.yourdomain.co.nz) and an email address for urgent renewal notices. It will then handle the challenge (proving domain ownership), obtain the certificate, and configure your web server to use it, including setting up HTTPS redirects.
B. For cPanel/Plesk Users:
- Log into your cPanel/Plesk dashboard.
- Navigate to the 'Security' section. Look for 'SSL/TLS Status', 'Let's Encrypt', or 'AutoSSL'.
- Select the domain(s) you wish to secure.
- Click 'Run AutoSSL' or 'Install' next to the Let's Encrypt option. The system will automatically perform the validation and installation.
Step 4: Configure Automatic Renewals
Let's Encrypt certificates are valid for 90 days. Manual renewal is impractical, so automation is crucial. Certbot sets up a cron job automatically on Linux servers.
A. For Apache/Nginx (via SSH/Certbot):
Certbot typically creates a cron job or systemd timer that runs daily to check for renewals. You can test it by running: sudo certbot renew --dry-run. If this command runs without errors, your automatic renewals are likely configured correctly.
B. For cPanel/Plesk Users:
Most cPanel/Plesk implementations of Let's Encrypt automatically handle renewals. Once installed, they will periodically check and renew your certificates before they expire, ensuring continuous HTTPS.
Step 5: Force HTTPS Redirect & Update Internal Links
After installation, ensure all traffic to your SSL NZ website is automatically redirected to HTTPS. This prevents users from accidentally accessing the insecure HTTP version.
- Certbot (Apache/Nginx): During installation, Certbot usually asks if you want to redirect HTTP to HTTPS. If you selected 'Yes', this is done.
- Manual Apache (.htaccess): Add these lines to your
.htaccess file in your document root:
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]
- Manual Nginx (server block):
server {
listen 80;
server_name yourdomain.co.nz www.yourdomain.co.nz;
return 301 https://$host$request_uri;
}
Finally, update any hard-coded http:// links within your website's content, theme, or database to https://. This is crucial for avoiding 'mixed content' warnings, where secure pages try to load insecure resources (images, scripts, CSS) over HTTP. For WordPress sites, use a plugin like 'Really Simple SSL' or update your 'WordPress Address (URL)' and 'Site Address (URL)' in General Settings to use https://.
