SSL Certificates
Secure connections between visitors and your site
HTTPS and SSL on Arcustech VPS
SSL encrypts traffic, protects logins and forms, and helps visitors connect securely to your website.
Our recommended modern setup: Put a CDN and abuse protection service in front of your site (Cloudflare, Bunny CDN, Fastly, etc.). A properly configured CDN can improve global performance, reduce unwanted traffic, and manage visitor-facing HTTPS certificates.
If you do not use a CDN, Arcustech's standard SSL solution for Managed VPS is Let's Encrypt, issued and renewed using our supported server-side automation.
Updated: October 2026
Why the SSL industry is changing
The maximum validity of newly issued, publicly trusted SSL/TLS certificates is being reduced in stages. This makes reliable automated issuance and renewal increasingly important.
- March 15, 2026: maximum validity of 200 days
- March 15, 2027: maximum validity of 100 days
- March 15, 2029: maximum validity of 47 days
These limits apply to certificates issued on or after each effective date. Previously issued certificates remain valid until their stated expiration. For details, see CA/Browser Forum Ballot SC-081v3.
SSL Certificate Management on Managed VPS
Arcustech provides automated SSL certificate issuance, installation, and renewal through Let's Encrypt using HTTP validation or DNS validation through a CNAME record. Both methods are fully supported. We do not require access to your DNS provider's API. Customers may also use compatible CDN or reverse proxy services to manage visitor-facing SSL certificates.
To maintain a consistent and reliable managed hosting environment, we do not install or maintain certificates issued through external certificate providers or their automation systems on Managed VPS.
Existing installed certificates can remain in use until expiration. Customers needing alternative certificate management arrangements may use our Self-Managed VPS services, which provide full administrative control over the server and its configuration.
Our supported SSL options
Option 1: Use a CDN (recommended)
We recommend placing a CDN and abuse protection service in front of your website. Cloudflare is a common option, including a free tier suitable for many sites. Other CDN providers may offer similar functionality depending on their services and configuration.
- Visitor-facing SSL: the CDN handles HTTPS certificates for connections from visitors
- Caching and abuse protection: can reduce load on your VPS and improve global performance
- Secure origin connection: the connection from the CDN to your Arcustech VPS must also be configured securely
For the secure connection between the CDN and your VPS, you can use a supported Let's Encrypt certificate. Some CDN providers also offer certificates specifically for this connection. For example, Cloudflare Origin CA certificates can be generated in the Cloudflare dashboard and installed on your VPS for use with Cloudflare's Full (strict) SSL mode. Cloudflare's documentation explains how to create one.
Cloudflare Origin CA certificates are intended for connections through Cloudflare, not direct browser connections to your VPS. They are different from publicly trusted certificates issued for visitors.
Option 2: Let's Encrypt on the server (standard)
Let's Encrypt is a free, automated Certificate Authority operated by the nonprofit Internet Security Research Group (ISRG). On Arcustech Managed VPS, we handle issuance, installation, and automated renewal for supported websites. There are two equally supported ways to validate your domain:
HTTP validation
HTTP validation is a simple, reliable choice for websites already pointed to their Arcustech VPS. Let's Encrypt confirms control of each domain through a temporary validation file served over HTTP. No special DNS validation record is needed.
- Works with your existing website DNS: requested domains must point to the correct server and be reachable for validation
- Multiple hostnames: certificates can cover specific names such as example.com and www.example.com, or other configured hostnames
- Automated renewal: our tools manage subsequent validation and renewal
- No wildcard certificates: each hostname to be covered must be included in the certificate
DNS CNAME validation
DNS validation is especially useful when you want SSL ready before pointing a domain to its new VPS, or when you need a wildcard certificate. We provide a validation-only CNAME record to add at your DNS provider, which allows our tools to complete certificate validation and renewal without needing DNS API access or credentials.
- Before DNS cutover: the website does not need to point to your Arcustech VPS yet
- Wildcard support: a certificate can include both example.com and *.example.com, covering the root domain and immediate subdomains
- No DNS API access required: you add the provided CNAME record once; no DNS provider API credentials are needed
- No change to website routing: the validation CNAME does not redirect visitors or move your DNS hosting
- Automated renewal: our tools reuse the validation configuration for future renewals
Both validation methods are equally supported. The best choice depends on whether your website already points to the VPS and whether wildcard coverage is needed. To get started, open a support ticket in the Arcustech Dashboard with the domain names you want secured. We will help select and configure the appropriate method.
We recommend independent SSL expiration monitoring even with automated renewal. Let's Encrypt provides a list of certificate monitoring options.
Certificates from other providers
Arcustech no longer sells or installs certificates issued by external providers on Managed VPS. This includes customer-supplied certificates from commercial Certificate Authorities and certificates provided through organizational or institutional programs. We also do not support third-party certificate renewal integrations, including external ACME services.
If your organization has a specific certificate requirement, a compatible CDN configuration may meet that need. Otherwise, our supported Let's Encrypt service provides automated SSL at no additional certificate cost.
Self-Managed VPS
Self-Managed VPS customers have root access and may choose their own SSL provider, ACME client, certificate deployment process, and web server configuration. Installation, renewals, monitoring, security, and troubleshooting of those systems remain the customer's responsibility. Arcustech does not provide managed support for those integrations.
Additional Details:
Can I purchase an SSL certificate from Arcustech?
No. Arcustech no longer sells commercial SSL certificates or installs externally issued certificates on Managed VPS. Our supported on-server solution is Let's Encrypt, with automated issuance and renewal through our tools. A compatible CDN-managed solution is another option.
Certificates supplied through outside providers or organizational programs are not installed or renewed as part of our Managed VPS service.
Does the validation CNAME affect my website traffic?
No. The CNAME record used for Let's Encrypt DNS validation is used to confirm domain control. It does not route website traffic or change the DNS records visitors use to reach your site. This method does not require access to your DNS provider's API.
Can SSL be set up before I move my DNS to Arcustech?
Yes. Let's Encrypt DNS validation allows us to issue a certificate before your website's A or AAAA records point to the Arcustech server. That way, HTTPS can be ready for your DNS cutover.
HTTP validation is equally supported once the requested hostnames are pointing to the Arcustech web server and can be reached for validation.
Is it recommended to use SSL on my whole site?
Yes. HTTPS should be enforced site-wide whenever practical. It helps protect visitor privacy and is the modern baseline for secure browser connections.
Can I have SSL on multiple domains on a single VPS?
Yes. Multiple domains can be secured using individual or multi-domain Let's Encrypt certificates, normally served through SNI (Server Name Indication). Wildcard certificates require DNS validation and cover only the applicable domain and subdomain levels. A CDN may also simplify visitor-facing SSL management across multiple sites.
Do you monitor SSL expirations for customers?
Our supported Let's Encrypt configurations include automated renewal, but external SSL expiration and website availability monitoring are not included as a Managed VPS service. Customers should independently monitor certificate validity and site availability. See Let's Encrypt's monitoring options.
Does Arcustech support certificates from other providers?
For Managed VPS, we use our supported Let's Encrypt automation for on-server certificates. We do not install customer-supplied certificates or integrate external certificate issuance and renewal services, including third-party ACME services.
Self-Managed VPS customers can choose and maintain their own certificate solutions.
What happens to an externally issued certificate already installed on my Managed VPS?
We are not removing currently installed certificates simply because this policy changed. They can continue to be used until they expire. Please contact support before then to transition to Let's Encrypt or arrange a compatible CDN solution.