How to Use ZeroSSL Free Certificates for Secure HTTPS
ZeroSSL offers free SSL/TLS certificates compatible with most web servers, including Apache, Nginx, and Lighttpd. It provides an excellent alternative to paid certificates and integrates easily with automation tools like acme.sh or Certbot. Below is a full walkthrough for setting up and renewing ZeroSSL certificates efficiently.
1. What is ZeroSSL?
ZeroSSL is a certificate authority that issues 90-day free SSL certificates using the ACME protocol. It’s fully trusted by all major browsers and devices. Certificates can be renewed automatically, similar to Let’s Encrypt. ZeroSSL provides both web-based and command-line enrollment methods.
2. Signing Up for a Free Account
Visit ZeroSSL Official Site Click on Get Free SSL and sign up for an account. After logging in, go to the Certificates dashboard. Click New Certificate and enter your domain (e.g., example.com). Choose 90-day Free Certificate to continue.
3. Domain Validation Methods
ZeroSSL supports three validation types: HTTP File Upload: You upload a small validation file to your website root. DNS CNAME Record: You add a validation record to your DNS manager. Email Validation: A confirmation email is sent to admin@yourdomain.com. Once validation completes, your certificate will be ready for download.
4. Downloading and Installing Certificates
After validation, download the certificate bundle from your ZeroSSL dashboard. Extract the files — typically you’ll receive:
Move these to your server’s SSL directory, such as /etc/ssl/zerossl/ Set strict permissions: chmod 600 /etc/ssl/zerossl/private.key
| File Name | Purpose |
| certificate.crt | The main public certificate |
| ca_bundle.crt | Intermediate certificate chain |
| private.key | Your private server key (keep secure) |
5. Configuring Apache or Nginx
For Apache:
For Nginx:
Restart your web server: systemctl restart apache2 or systemctl restart nginx
SSLEngine on
SSLCertificateFile /etc/ssl/zerossl/certificate.crt
SSLCertificateKeyFile /etc/ssl/zerossl/private.key
SSLCertificateChainFile /etc/ssl/zerossl/ca_bundle.crt
SSLCertificateFile /etc/ssl/zerossl/certificate.crt
SSLCertificateKeyFile /etc/ssl/zerossl/private.key
SSLCertificateChainFile /etc/ssl/zerossl/ca_bundle.crt
ssl_certificate /etc/ssl/zerossl/certificate.crt;
ssl_certificate_key /etc/ssl/zerossl/private.key;
ssl_trusted_certificate /etc/ssl/zerossl/ca_bundle.crt;
ssl_certificate_key /etc/ssl/zerossl/private.key;
ssl_trusted_certificate /etc/ssl/zerossl/ca_bundle.crt;
6. Automating Renewals with acme.sh
Install acme.sh: curl https://get.acme.sh | sh Register your ZeroSSL account key: acme.sh --register-account -m your@email.com --server zerossl Issue a certificate: acme.sh --issue -d example.com --nginx --server zerossl Install the issued certificate automatically:
Set a cron job to renew automatically every 60 days.
acme.sh --install-cert -d example.com \
--key-file /etc/ssl/zerossl/private.key \
--fullchain-file /etc/ssl/zerossl/certificate.crt \
--reloadcmd "systemctl reload nginx"
--key-file /etc/ssl/zerossl/private.key \
--fullchain-file /etc/ssl/zerossl/certificate.crt \
--reloadcmd "systemctl reload nginx"
7. Verifying SSL Installation
Check syntax: nginx -t or apachectl configtest Restart the server after applying SSL changes. Verify certificate using: openssl s_client -connect example.com:443 -servername example.com Look for “Verify return code: 0 (ok)” in the output. You can also test via SSL Labs Server Test
8. Tips for Best Practice
Always keep HTTP to HTTPS redirects enabled. Renew early — don’t wait for expiration dates. Use HSTS headers to enforce HTTPS: Strict-Transport-Security Secure private keys with strict permissions and backups. Monitor SSL expiration via cron or external uptime tools.
9. Troubleshooting Common Errors
| Issue | Possible Fix |
| Validation failed | Check DNS or ensure HTTP challenge file is accessible publicly |
| Chain incomplete | Include ca_bundle.crt in the configuration |
| Server mismatch | Ensure certificate CN matches the domain exactly |
| Browser warning | Clear cache and recheck using https:// |
10. Useful Links
ZeroSSL Official Page acme.sh Automation Script SSL Labs Analyzer Nginx HTTPS Guide Apache SSL How-To
Conclusion:
ZeroSSL provides a simple, free, and highly trusted method to encrypt your website traffic with HTTPS. Whether you manage a personal blog or an enterprise API, automating with ACME and monitoring renewals ensures a secure, reliable online presence. When combined with strong server hardening and SELinux, it creates a professional-grade secure environment with zero cost.
ZeroSSL provides a simple, free, and highly trusted method to encrypt your website traffic with HTTPS. Whether you manage a personal blog or an enterprise API, automating with ACME and monitoring renewals ensures a secure, reliable online presence. When combined with strong server hardening and SELinux, it creates a professional-grade secure environment with zero cost.