{"id":188,"date":"2026-06-01T05:30:06","date_gmt":"2026-06-01T05:30:06","guid":{"rendered":"https:\/\/blog.offshorekaka.in\/?p=188"},"modified":"2026-08-27T05:43:44","modified_gmt":"2026-08-27T05:43:44","slug":"install-ssl-certificate-offshore-hosting","status":"publish","type":"post","link":"https:\/\/offshorekaka.in\/blog\/install-ssl-certificate-offshore-hosting\/","title":{"rendered":"How to Install an SSL Certificate on Offshore Hosting"},"content":{"rendered":"
\n

Installation Guides<\/span><\/p>\n

The padlock, in about five minutes<\/h2>\n

A certificate from Let’s Encrypt is free, automated and trusted by every browser. On an offshore hosting<\/a> account with a panel it is usually one click. On a plain VPS it is one command. Neither costs anything.<\/p>\n

What actually goes wrong is rarely the certificate itself. It is DNS not pointing at the server yet, port 80 being closed, or a renewal that silently stopped working three months ago. This guide covers all three.<\/p>\n

\n
Time<\/strong>5 minutes.<\/span><\/div>\n
Cost<\/strong>Nothing.<\/span><\/div>\n
Valid for<\/strong>90 days, renewed automatically.<\/span><\/div>\n<\/div>\n<\/div>\n
On this page<\/strong>Two things to check first<\/a>Issuing the certificate<\/a>Verifying it<\/a>Renewal, the part that breaks<\/a>If you use Cloudflare<\/a>FAQ<\/a><\/div>\n

Two things to check first<\/h2>\n

Certbot proves you control the domain by serving a file over HTTP. So two things have to be true before it can work.<\/p>\n

DNS points at this server:<\/strong><\/p>\n

dig +short yourdomain.com<\/code><\/pre>\n
That must return this server’s IP. If it returns your old host, issuing will fail with an authorisation error, and the error message will not say why.<\/p>\n
Port 80 is open.<\/strong> Even if your site only serves HTTPS, the validation happens over port 80. Close it and validation cannot complete:<\/p>\n
ufw status | grep 80<\/code><\/pre>\n
Issuing the certificate<\/h2>\n
apt install certbot python3-certbot-nginx -y\ncertbot --nginx -d yourdomain.com -d www.yourdomain.com<\/code><\/pre>\n
Use python3-certbot-apache<\/code> and --apache<\/code> on Apache. Certbot edits the vhost for you, adds the certificate paths and sets up the HTTP to HTTPS redirect.<\/p>\n
Include both the bare domain and www. They are separate names as far as a certificate is concerned, and leaving one out means half your visitors get a warning.<\/p>\n
Verifying it<\/h2>\n
Do not just look for the padlock. Read what the server is actually serving:<\/p>\n
echo | openssl s_client -servername yourdomain.com -connect yourdomain.com:443 2>\/dev\/null | openssl x509 -noout -subject -issuer -dates<\/code><\/pre>\n
\"Terminal
Subject, issuer and both dates. This is the certificate the server is really handing out.<\/figcaption><\/figure>\n
Check the subject matches your domain and that notAfter is in the future. This command is also the fastest way to answer “is the certificate about to expire”, which is worth checking now and then even with auto renewal on.<\/p>\n
Then confirm HTTP redirects to HTTPS rather than serving both:<\/p>\n
curl -sI http:\/\/yourdomain.com | head -3<\/code><\/pre>\n
You want a 301 to the https address. Serving the same page on both is a duplicate content problem as well as a security one.<\/p>\n
Renewal, the part that actually breaks<\/h2>\n
Certificates last 90 days. Certbot installs a timer that renews at around 60 days, so in theory you never think about it again. In practice renewals fail quietly, and you find out when a visitor tells you the site is showing a warning.<\/p>\n
certbot renew --dry-run<\/code><\/pre>\n
That runs the whole renewal without actually renewing. If it passes, renewal works. Run it once now, and again any time you change the web server config.<\/p>\n
The two things that break renewals later:<\/p>\n