Get started now or speak directly with our engineering team for specialized assistance.
After configuring your cloud security lists and opening web ports on Oracle Cloud, the next milestone is attaching a custom domain name. Securing all browser traffic with an encrypted HTTPS SSL/TLS Certificate is essential for production sites.
Requiring visitors to access your site using an unencrypted IP address triggers browser warnings, harms consumer trust, and hurts Google search rankings. This tutorial walks you through:
If you have not opened ports 80 and 443 on your OCI Virtual Network yet, begin by following our guide on Opening Ports 80 & 443 on Oracle Cloud VPS.
Prefer automated domain pointing and zero-maintenance SSL provisioning? Avoid manual Nginx configuration files and terminal SSL renewals by hosting your sites on RackUp IT's Managed VPS Hosting Plans, featuring one-click free SSL issuance and automated custom domain routing.
Before requesting an encrypted SSL certificate, your custom domain name must resolve globally to your Oracle Cloud instance's public IP address across worldwide domain name servers (DNS).
Log into your Oracle Cloud Infrastructure Console and navigate to Compute > Instances > Instance Details. Copy your instance's Public IP Address.
Log into your Domain Registrar DNS Management Dashboard (such as Cloudflare, Namecheap, GoDaddy, or NameSilo).
Add the following two DNS A-Records to your DNS zone file:
Record Type: A | Host / Name: @ | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds
Record Type: A | Host / Name: www | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds
DNS Propagation Verification: Domain Name System propagation across global edge DNS servers typically takes between 2 to 15 minutes depending on your domain registrar's TTL settings. Verify DNS propagation by opening your local computer terminal and running dig +short yourdomain.com or nslookup yourdomain.com. Once the diagnostic command returns your exact Oracle Public IP address, DNS propagation is successfully established!
Connect to your Oracle Cloud instance via SSH and create a dedicated web document root directory and Nginx virtual host configuration file for your custom domain:
# Create root directory for your domain web files
sudo mkdir -p /var/www/yourdomain.com/html
# Grant ownership permissions to your current system user
sudo chown -R $USER:$USER /var/www/yourdomain.com/html
# Create an initial index.html test document
echo "<h1>Welcome to yourdomain.com hosted on Oracle Cloud VPS!</h1>" > /var/www/yourdomain.com/html/index.html
# Create a new Nginx virtual host configuration file
sudo nano /etc/nginx/sites-available/yourdomain.comPaste the following HTTP server block configuration inside your file:
server {
listen 80;
listen [::]:80;
server_name yourdomain.com www.yourdomain.com;
root /var/www/yourdomain.com/html;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
# Enable gzip compression for faster web page load speeds
gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
gzip_min_length 1000;
}Enable your site configuration symlink and verify Nginx syntax before reloading the web service daemon:
# Create a symbolic link to activate your site configuration
sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
# Verify Nginx configuration syntax for errors
sudo nginx -t
# Reload Nginx web service daemon
sudo systemctl reload nginxWe will utilize Certbot, an automated client developed by the Electronic Frontier Foundation (EFF), to issue and install a free 90-day Let's Encrypt TLS/SSL certificate.
Run the following package manager commands on your Ubuntu or Debian instance:
# Update package repositories and install Certbot Nginx plugin
sudo apt update
sudo apt install -y certbot python3-certbot-nginx
# Request SSL Certificate and automatically configure HTTPS redirects
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comDuring the Certbot interactive installation wizard:
Provide a valid administrator email address for urgent security and renewal notifications.
Accept the Let's Encrypt Subscriber Agreement by typing Y.
Certbot will perform an ACME HTTP-01 challenge verification over port 80, issue your cryptographic keys, and automatically append SSL configuration parameters and 301 HTTPS redirects to your Nginx configuration file!
If you intend to host WordPress on your new SSL domain, check out our walkthrough on Setting up WordPress on Oracle Cloud Free Tier.
Click the button below to learn more and get started.
Let's Encrypt SSL certificates remain valid for 90 days. Certbot automatically configures a background systemd timer (certbot.timer) that inspects your certificates twice daily and renews any certificate within 30 days of expiration.
Test your automated renewal mechanism by running a simulation dry-run:
# Execute Certbot renewal dry-run test
sudo certbot renew --dry-runIf the terminal prints Account registered. Simulating renewal... Congratulations, all simulated renewals succeeded!, your domain's HTTPS encryption will renew automatically without manual maintenance!
To maximize browser performance and security scores on Google PageSpeed Insights, verify that your Nginx SSL configuration enables HTTP/2 protocol multiplexing and HSTS security headers:
# Edit your generated SSL server block
sudo nano /etc/nginx/sites-available/yourdomain.comEnsure your SSL listen directive and security headers include the following parameters:
listen 443 ssl http2; # managed by Certbot
# Enable HTTP Strict Transport Security (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Test Nginx configuration syntax and reload the web server daemon: sudo nginx -t && sudo systemctl reload nginx.
If you encounter unexpected errors during domain pointing or certificate issuance, consult these diagnostic solutions:
Certbot DNS Validation Failures: Verify that both yourdomain.com and www.yourdomain.com point to your exact Oracle Public IP address before invoking Certbot.
Firewall Blocking Port 80: Certbot requires port 80 to be open for ACME challenge validation. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.
Cloudflare Proxy Conflicts: If using Cloudflare DNS with the Orange Cloud Proxy enabled, set Cloudflare SSL/TLS encryption mode to Full (Strict) after installing your Certbot certificate.
Why does Certbot fail with "Connection Refused" or "Timeout"?
Certbot validates domain ownership via an ACME HTTP-01 challenge over port 80. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.
Can I use Cloudflare Flexible SSL instead of Certbot?
Cloudflare Flexible SSL encrypts traffic strictly between the user browser and Cloudflare. Traffic between Cloudflare and your Oracle VPS remains unencrypted. Installing Certbot allows Cloudflare Full (Strict) mode, guaranteeing complete end-to-end encryption.
What happens if my Oracle Public IP Address changes?
Oracle Cloud Ephemeral Public IPs remain static as long as the instance stays running. To prevent IP changes during VM restarts, assign a free Reserved Public IP in the OCI Console under Networking > IP Management.
How do I fix SSL Mixed Content warnings?
Mixed content warnings occur when an HTTPS webpage requests unencrypted HTTP assets (images, scripts, or CSS files). Update your web application database or template paths to use relative URLs or explicit https:// prefixes.
How do I point multiple domains to the same Oracle Cloud VPS instance?
To host multiple websites or staging subdomains on a single Oracle Cloud instance, repeat Step 2 and Step 3 for each domain name. Create a separate Nginx server block in /etc/nginx/sites-available/ and run sudo certbot --nginx -d newdomain.com for each site.
Unsure Which Cloud Hosting Plan Fits Your Site?
Answer 4 quick diagnostic questions to calculate your exact server CPU, RAM, and NVMe SSD hardware requirements with transparent pricing.
Cloud Infrastructure Engineer and technical writer specializing in VPS setups and network configurations.
Hosting & SEOLearn how shared server slowdowns, noisy neighbors, and high TTFB harm your Core Web Vitals, causing Google to demote your website in organic search rankings.
Server StackA technical benchmark comparison evaluating LiteSpeed Enterprise LSCache against Nginx for high-concurrency WordPress and web application hosting.
E-CommerceDiscover exact vCPU, RAM, and NVMe hardware specifications needed to run a fast WooCommerce store with zero checkout slowdowns.