ConfigClarity

Free browser-based DevOps audit tools — no signup, nothing leaves your browser

Home › Providers › Vultr

SSL certificates on Vultr

Let's Encrypt with nginx or Traefik on Vultr instances

Option 1 — Certbot with nginx

✅ Certbot installation on Ubuntu 
sudo apt update
sudo apt install certbot python3-certbot-nginx

# Get certificate (replace with your domain)
sudo certbot --nginx -d example.com -d www.example.com

# Auto-renewal is set up automatically
# Test renewal:
sudo certbot renew --dry-run

Option 2 — Traefik with automatic certificates

✅ Traefik v3 with Let's Encrypt 
services:
  traefik:
    image: traefik:v3
    command:
      - "--certificatesresolvers.myresolver.acme.email=you@example.com"
      - "--certificatesresolvers.myresolver.acme.storage=/letsencrypt/acme.json"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - "./letsencrypt:/letsencrypt"
      - "/var/run/docker.sock:/var/run/docker.sock"
  
  app:
    image: myapp
    labels:
      - "traefik.http.routers.app.rule=Host('example.com')"
      - "traefik.http.routers.app.tls=true"
      - "traefik.http.routers.app.tls.certresolver=myresolver"

Vultr firewall — allow ports 80 and 443

In Vultr's firewall settings, ensure inbound rules allow TCP port 80 (for ACME HTTP-01 challenge) and TCP port 443. Let's Encrypt requires port 80 to be accessible for certificate issuance.

Monitor SSL expiry across all your Vultr instances

Paste all your domain names and see expiry dates at a glance. Color coded: green (safe), orange (<30 days), red (<7 days).

Open SSL Checker →

Frequently Asked Questions

Does Vultr block port 80 by default?

Vultr's default firewall allows all inbound traffic. You need to add restrictive rules yourself. However, the ACME HTTP-01 challenge requires port 80 to be open. If you block port 80, use DNS-01 challenge instead.

How do I renew Let's Encrypt certificates automatically?

Certbot installs a systemd timer that runs twice daily. Check its status with systemctl status certbot.timer. For Traefik, renewal is automatic — Traefik renews certificates 30 days before expiry.