Securing your website with HTTPS is no longer optional — it’s a baseline requirement for user trust, SEO rankings, and browser compatibility. Let’s Encrypt makes this easy by offering free, automated SSL/TLS certificates through a nonprofit Certificate Authority backed by the Internet Security Research Group (ISRG).

In this guide, you’ll learn how to install and configure a free Let’s Encrypt SSL certificate on a CentOS server running Apache, using Certbot (the modern, actively maintained successor to the original letsencrypt-auto client). We’ll also cover certificate renewal automation and a bonus section for zPanel users.

Why Use Let’s Encrypt for SSL?

  • Free — no licensing or purchase cost, unlike traditional SSL vendors
  • Automated — issuance and renewal can be fully scripted
  • Trusted — certificates are recognized by all major browsers
  • Short-lived by design — certificates are valid for 90 days, encouraging automated renewal and better long-term security hygiene

Prerequisites

Before you begin, make sure you have:

  1. A CentOS server (CentOS 7 or 8; steps are similar for CentOS Stream and RHEL-based distros)
  2. Apache (httpd) installed and serving your website
  3. Root or sudo access to the server
  4. A registered domain name with DNS A record pointing to your server’s public IP address
  5. Port 80 and 443 open in your firewall / security group
  6. A valid email address for renewal and security notifications

Note: The original letsencrypt-auto tool referenced in older tutorials has been deprecated. The steps below use Certbot, which is the officially supported client for issuing and renewing Let’s Encrypt certificates today.

Step 1: Update Your System and Install Required Packages

Start by updating your package index and installing EPEL (Extra Packages for Enterprise Linux), which provides access to the Certbot package:

sudo yum update -y
sudo yum install epel-release -y

Step 2: Install Certbot and the Apache Plugin

Install Certbot along with the Apache plugin, which automatically detects and configures your virtual host:

sudo yum install certbot python3-certbot-apache -y

Step 3: Verify Apache Is Running

Confirm Apache is active and listening on port 80, since Certbot needs to reach your domain over HTTP to validate ownership:

sudo systemctl status httpd

If it’s not running, start it:

sudo systemctl start httpd
sudo systemctl enable httpd

Step 4: Obtain and Install the SSL Certificate

Run Certbot with the Apache plugin. This single command validates your domain, issues the certificate, and configures Apache’s SSL virtual host automatically:

sudo certbot --apache -d domain.tld -d www.domain.tld

During the process, Certbot will prompt you to:

  • Enter a recovery/notification email address
  • Agree to the Let’s Encrypt Terms of Service
  • Choose whether to redirect all HTTP traffic to HTTPS (recommended: choose yes)

On success, you’ll see a confirmation similar to:

Congratulations! You have successfully enabled HTTPS on
https://domain.tld and https://www.domain.tld
Your certificate and chain have been saved at:
/etc/letsencrypt/live/domain.tld/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/domain.tld/privkey.pem
Your certificate will expire on 2026-11-06.

Step 5: Review the Apache SSL Configuration (Optional Manual Setup)

Certbot typically writes the SSL configuration for you, but if you’re configuring a virtual host manually, use a modern, secure cipher configuration like this:

ServerName domain.tld
ServerAlias www.domain.tld
DocumentRoot "/var/www/html"
SSLEngine on
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLCertificateFile /etc/letsencrypt/live/domain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.tld/privkey.pem

Security tip: Avoid enabling SSLv2, SSLv3, or 3DES ciphers — these are outdated and considered insecure by modern standards. Stick to TLS 1.2 and TLS 1.3.

Restart Apache to apply any manual changes:

sudo systemctl restart httpd

Step 6: Verify Your SSL Installation

Confirm your certificate is installed correctly using a free SSL checker tool, such as SSL Labs’ SSL Test. A correct installation should show a valid chain of trust with no configuration warnings.

Step 7: Automate Certificate Renewal

Let’s Encrypt certificates expire every 90 days, so automated renewal is essential. Certbot installs a systemd timer or cron job by default, but you can verify and test it manually:

sudo certbot renew --dry-run

If you prefer an explicit cron entry, add one to run twice daily (Certbot’s recommended frequency), which only renews certificates nearing expiration:

sudo crontab -e

0 0,12 * * * /usr/bin/certbot renew --quiet --post-hook "systemctl reload httpd"

Bonus: Configuring SSL on zPanel

If you’re managing your server through zPanel, you can still use Certbot to obtain the certificate (sudo certbot certonly --standalone -d domain.tld), then apply it through the control panel:

  1. Go to zPanel > Module Admin > Apache Config > Override a Virtualhost
  2. Select domain.tld from the dropdown list
  3. Set the following:
    • Port Override: 443
    • Forward Port 80 to Overridden Port: Enable
  4. Add this SSL configuration block:
SSLEngine on
SSLProtocol -all +TLSv1.2 +TLSv1.3
SSLHonorCipherOrder On
SSLCipherSuite HIGH:!aNULL:!MD5:!3DES
SSLCertificateFile /etc/letsencrypt/live/domain.tld/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/domain.tld/privkey.pem
  1. Apply the changes:
php -q /etc/zpanel/panel/bin/daemon.php
  1. Restart Apache:
sudo systemctl restart httpd

Frequently Asked Questions

Is Let’s Encrypt SSL as secure as a paid certificate? Yes. Let’s Encrypt issues Domain Validation (DV) certificates using the same encryption standards as paid DV certificates. The main differences with paid options are extended validation branding and support SLAs, not encryption strength.

How often do I need to renew my certificate? Every 90 days. Setting up the automated renewal in Step 7 means you won’t need to do this manually.

Can I use Let’s Encrypt on multiple subdomains? Yes — add multiple -d flags to the Certbot command, for example: -d domain.tld -d www.domain.tld -d shop.domain.tld.

What happens if my certificate expires? Visitors will see browser security warnings and HTTPS connections will fail until the certificate is renewed. This is why automated renewal is critical.

Conclusion

Installing SSL with Let’s Encrypt on CentOS is quick, free, and — with Certbot — largely automated from issuance through renewal. By following the steps above, you’ll have a fully working HTTPS setup on Apache, a hardened cipher configuration, and a renewal job that keeps your certificate valid without manual intervention.

Post Views: 223

Leave a Reply