Get started now or speak directly with our engineering team for specialized assistance.
Once you have configured your cloud security lists and opened web traffic ports on your Oracle Cloud Infrastructure (OCI) Virtual Machine, the next fundamental milestone in launching a production-ready website is attaching a custom domain name (such as yourdomain.com) and securing all browser communications with an encrypted HTTPS SSL/TLS Certificate.
Requiring visitors to access your web applications or REST APIs using an unencrypted numeric IP address (like http://140.238.x.x) triggers intrusive browser security warnings, undermines consumer trust, and severely penalizes your search engine visibility on Google. In this comprehensive step-by-step tutorial, we will walk through pointing DNS A-records, configuring Nginx virtual host server blocks, issuing a free Let's Encrypt SSL certificate via Certbot, setting up automated 90-day certificate renewals, and implementing HTTP/2 performance optimizations on Oracle Cloud VPS.
If you have not opened ports 80 and 443 on your OCI Virtual Network yet, begin by following our guide on Opening Ports 80 & 443 on Oracle Cloud VPS.
Prefer automated domain pointing and zero-maintenance SSL provisioning? Avoid manual Nginx configuration files and terminal SSL renewals by hosting your sites on RackUp IT's Managed VPS Hosting Plans, featuring one-click free SSL issuance and automated custom domain routing.
Before requesting an encrypted SSL certificate, your custom domain name must resolve globally to your Oracle Cloud instance's public IP address across worldwide domain name servers (DNS).
Log into your Oracle Cloud Infrastructure Console and navigate to Compute > Instances > Instance Details. Copy your instance's Public IP Address.
Log into your Domain Registrar DNS Management Dashboard (such as Cloudflare, Namecheap, GoDaddy, or NameSilo).
Add the following two DNS A-Records to your DNS zone file:
Record Type: A | Host / Name: @ | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds
Record Type: A | Host / Name: www | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds
DNS Propagation Verification: Domain Name System propagation across global edge DNS servers typically takes between 2 to 15 minutes depending on your domain registrar's TTL settings. Verify DNS propagation by opening your local computer terminal and running dig +short yourdomain.com or nslookup yourdomain.com. Once the diagnostic command returns your exact Oracle Public IP address, DNS propagation is successfully established!
Connect to your Oracle Cloud instance via SSH and create a dedicated web document root directory and Nginx virtual host configuration file for your custom domain:
# Create root directory for your domain web files
sudo mkdir -p /var/www/yourdomain.com/html
# Grant ownership permissions to your current system user
sudo chown -R $USER:$USER /var/www/yourdomain.com/html
# Create an initial index.html test document
echo "<h1>Welcome to yourdomain.com hosted on Oracle Cloud VPS!</h1>" > /var/www/yourdomain.com/html/index.html
# Create a new Nginx virtual host configuration file
sudo nano /etc/nginx/sites-available/yourdomain.comPaste the following HTTP server block configuration inside your file:
server {
listen 80;
listen [::]:80;
server_name yourdomain.com www.yourdomain.com;
root /var/www/yourdomain.com/html;
index index.html index.htm;
location / {
try_files $uri $uri/ =404;
}
# Enable gzip compression for faster web page load speeds
gzip on;
gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
gzip_min_length 1000;
}Enable your site configuration symlink and verify Nginx syntax before reloading the web service daemon:
# Create a symbolic link to activate your site configuration
sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
# Verify Nginx configuration syntax for errors
sudo nginx -t
# Reload Nginx web service daemon
sudo systemctl reload nginxWe will utilize Certbot, an automated client developed by the Electronic Frontier Foundation (EFF), to issue and install a free 90-day Let's Encrypt TLS/SSL certificate.
Run the following package manager commands on your Ubuntu or Debian instance:
# Update package repositories and install Certbot Nginx plugin
sudo apt update
sudo apt install -y certbot python3-certbot-nginx
# Request SSL Certificate and automatically configure HTTPS redirects
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comDuring the Certbot interactive installation wizard:
Provide a valid administrator email address for urgent security and renewal notifications.
Accept the Let's Encrypt Subscriber Agreement by typing Y.
Certbot will perform an ACME HTTP-01 challenge verification over port 80, issue your cryptographic keys, and automatically append SSL configuration parameters and 301 HTTPS redirects to your Nginx configuration file!
If you intend to host WordPress on your new SSL domain, check out our walkthrough on Setting up WordPress on Oracle Cloud Free Tier.
Click the button below to learn more and get started.
Let's Encrypt SSL certificates remain valid for 90 days. Certbot automatically configures a background systemd timer (certbot.timer) that inspects your certificates twice daily and renews any certificate within 30 days of expiration.
Test your automated renewal mechanism by running a simulation dry-run:
# Execute Certbot renewal dry-run test
sudo certbot renew --dry-runIf the terminal prints Account registered. Simulating renewal... Congratulations, all simulated renewals succeeded!, your domain's HTTPS encryption will renew automatically without manual maintenance!
To maximize browser performance and security scores on Google PageSpeed Insights, verify that your Nginx SSL configuration enables HTTP/2 protocol multiplexing and HSTS security headers:
# Edit your generated SSL server block
sudo nano /etc/nginx/sites-available/yourdomain.comEnsure your SSL listen directive and security headers include the following parameters:
listen 443 ssl http2; # managed by Certbot
# Enable HTTP Strict Transport Security (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;Test Nginx configuration syntax and reload the web server daemon: sudo nginx -t && sudo systemctl reload nginx.
If you encounter unexpected errors during domain pointing or certificate issuance, consult these diagnostic solutions:
Certbot DNS Validation Failures: Verify that both yourdomain.com and www.yourdomain.com point to your exact Oracle Public IP address before invoking Certbot.
Firewall Blocking Port 80: Certbot requires port 80 to be open for ACME challenge validation. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.
Cloudflare Proxy Conflicts: If using Cloudflare DNS with the Orange Cloud Proxy enabled, set Cloudflare SSL/TLS encryption mode to Full (Strict) after installing your Certbot certificate.
Why does Certbot fail with "Connection Refused" or "Timeout"?
Certbot validates domain ownership via an ACME HTTP-01 challenge over port 80. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.
Can I use Cloudflare Flexible SSL instead of Certbot?
Cloudflare Flexible SSL encrypts traffic strictly between the user browser and Cloudflare. Traffic between Cloudflare and your Oracle VPS remains unencrypted. Installing Certbot allows Cloudflare Full (Strict) mode, guaranteeing complete end-to-end encryption.
What happens if my Oracle Public IP Address changes?
Oracle Cloud Ephemeral Public IPs remain static as long as the instance stays running. To prevent IP changes during VM restarts, assign a free Reserved Public IP in the OCI Console under Networking > IP Management.
How do I fix SSL Mixed Content warnings?
Mixed content warnings occur when an HTTPS webpage requests unencrypted HTTP assets (images, scripts, or CSS files). Update your web application database or template paths to use relative URLs or explicit https:// prefixes.
How do I point multiple domains to the same Oracle Cloud VPS instance?
To host multiple websites or staging subdomains on a single Oracle Cloud instance, repeat Step 2 and Step 3 for each domain name. Create a separate Nginx server block in /etc/nginx/sites-available/ and run sudo certbot --nginx -d newdomain.com for each site.
Cloud Infrastructure Engineer.
Managed VPSLeeds independent retailers need fast, stable websites to capture local shoppers. Discover the best local web hosting options and why managed VPS containers prevent slow checkouts.
VPS HostingStuck with ERR_CONNECTION_TIMED_OUT on Oracle Cloud Free Tier? Learn the step-by-step fix for opening port 80 & 443 across OCI VCN Security Lists and Ubuntu iptables/ufw firewalls.
WordPress HostingA complete step-by-step guide to hosting WordPress on Oracle Cloud Free Tier. Learn how to launch an Ubuntu instance, open OCI firewalls, install CloudPanel, and host at zero cost.