Let's Encrypt issues free TLS certificates that auto-renew — there's no excuse for plain HTTP anymore. The only question is which tool requests them.
The easiest paths
| Tool | Best for |
|---|---|
| Caddy | Zero-config — gets & renews certs automatically (Reverse Proxy with Caddy and Nginx) |
| certbot | Classic, integrates with Nginx/Apache |
| acme.sh | Shell-based, great for DNS-01 / wildcards |
certbot in one line
sudo certbot --nginx -d example.com -d www.example.com
# renewal is installed automatically; test it:
sudo certbot renew --dry-runHTTP-01 vs DNS-01
| Challenge | Use when |
|---|---|
| HTTP-01 | Public port 80 reachable; simplest |
| DNS-01 | Wildcards (*.example.com) or no public port |
Good practice
- Auto-renew (certbot/Caddy do this) — expired certs are a top outage cause.
- Enable HSTS once you're confident in HTTPS.
- Behind Cloudflare, TLS can terminate at the edge instead (Hosting Many Sites Behind One Cloudflare Tunnel).
Related background: SAN Certificates on Ubuntu and Tailscale Serve on 443 While Apache Stays on 80 (which provisions certs for you on a tailnet).
Related: Reverse Proxy with Caddy and Nginx · SAN Certificates on Ubuntu · Apache Web Server Hardening Guide