How to Point Custom Domain & Setup Free SSL on Oracle Cloud VPS

How to Point Custom Domain & Setup Free SSL on Oracle Cloud VPS

After configuring your cloud security lists and opening web ports on Oracle Cloud, the next milestone is attaching a custom domain name. Securing all browser traffic with an encrypted HTTPS SSL/TLS Certificate is essential for production sites.

Requiring visitors to access your site using an unencrypted IP address triggers browser warnings, harms consumer trust, and hurts Google search rankings. This tutorial walks you through:

• Pointing DNS A-records to your Oracle instance

• Configuring Nginx virtual host server blocks

• Issuing a free Let's Encrypt SSL certificate via Certbot

• Enabling automated 90-day renewals and HTTP/2 speed optimizations

If you have not opened ports 80 and 443 on your OCI Virtual Network yet, begin by following our guide on Opening Ports 80 & 443 on Oracle Cloud VPS.

Prefer automated domain pointing and zero-maintenance SSL provisioning? Avoid manual Nginx configuration files and terminal SSL renewals by hosting your sites on RackUp IT's Managed VPS Hosting Plans, featuring one-click free SSL issuance and automated custom domain routing.

Step 1: Point Domain DNS A-Records to Your Oracle Public IP Address

Before requesting an encrypted SSL certificate, your custom domain name must resolve globally to your Oracle Cloud instance's public IP address across worldwide domain name servers (DNS).

1. Log into your Oracle Cloud Infrastructure Console and navigate to Compute > Instances > Instance Details. Copy your instance's Public IP Address.

2. Log into your Domain Registrar DNS Management Dashboard (such as Cloudflare, Namecheap, GoDaddy, or NameSilo).

3. Add the following two DNS A-Records to your DNS zone file:

   • Record Type: A | Host / Name: @ | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds

   • Record Type: A | Host / Name: www | Value / Target: <YOUR_ORACLE_PUBLIC_IP> | TTL: Automatic / 300 Seconds

DNS Propagation Verification: Domain Name System propagation across global edge DNS servers typically takes between 2 to 15 minutes depending on your domain registrar's TTL settings. Verify DNS propagation by opening your local computer terminal and running dig +short yourdomain.com or nslookup yourdomain.com. Once the diagnostic command returns your exact Oracle Public IP address, DNS propagation is successfully established!

Step 2: Configure Nginx Virtual Host (Server Block)

Connect to your Oracle Cloud instance via SSH and create a dedicated web document root directory and Nginx virtual host configuration file for your custom domain:

# Create root directory for your domain web files
sudo mkdir -p /var/www/yourdomain.com/html

# Grant ownership permissions to your current system user
sudo chown -R $USER:$USER /var/www/yourdomain.com/html

# Create an initial index.html test document
echo "<h1>Welcome to yourdomain.com hosted on Oracle Cloud VPS!</h1>" > /var/www/yourdomain.com/html/index.html

# Create a new Nginx virtual host configuration file
sudo nano /etc/nginx/sites-available/yourdomain.com

Paste the following HTTP server block configuration inside your file:

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/yourdomain.com/html;
    index index.html index.htm;

    location / {
        try_files $uri $uri/ =404;
    }

    # Enable gzip compression for faster web page load speeds
    gzip on;
    gzip_types text/plain text/css application/json application/javascript text/xml application/xml;
    gzip_min_length 1000;
}

Enable your site configuration symlink and verify Nginx syntax before reloading the web service daemon:

# Create a symbolic link to activate your site configuration
sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/

# Verify Nginx configuration syntax for errors
sudo nginx -t

# Reload Nginx web service daemon
sudo systemctl reload nginx

Step 3: Install Certbot & Obtain Free Let's Encrypt SSL Certificate

We will utilize Certbot, an automated client developed by the Electronic Frontier Foundation (EFF), to issue and install a free 90-day Let's Encrypt TLS/SSL certificate.

Run the following package manager commands on your Ubuntu or Debian instance:

# Update package repositories and install Certbot Nginx plugin
sudo apt update
sudo apt install -y certbot python3-certbot-nginx

# Request SSL Certificate and automatically configure HTTPS redirects
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

During the Certbot interactive installation wizard:

1. Provide a valid administrator email address for urgent security and renewal notifications.

2. Accept the Let's Encrypt Subscriber Agreement by typing Y.

3. Certbot will perform an ACME HTTP-01 challenge verification over port 80, issue your cryptographic keys, and automatically append SSL configuration parameters and 301 HTTPS redirects to your Nginx configuration file!

If you intend to host WordPress on your new SSL domain, check out our walkthrough on Setting up WordPress on Oracle Cloud Free Tier.

Step 4: Verify Automated SSL Certificate Renewals

Let's Encrypt SSL certificates remain valid for 90 days. Certbot automatically configures a background systemd timer (certbot.timer) that inspects your certificates twice daily and renews any certificate within 30 days of expiration.

Test your automated renewal mechanism by running a simulation dry-run:

# Execute Certbot renewal dry-run test
sudo certbot renew --dry-run

If the terminal prints Account registered. Simulating renewal... Congratulations, all simulated renewals succeeded!, your domain's HTTPS encryption will renew automatically without manual maintenance!

Step 5: Security Hardening & HTTP/2 Acceleration

To maximize browser performance and security scores on Google PageSpeed Insights, verify that your Nginx SSL configuration enables HTTP/2 protocol multiplexing and HSTS security headers:

# Edit your generated SSL server block
sudo nano /etc/nginx/sites-available/yourdomain.com

Ensure your SSL listen directive and security headers include the following parameters:

listen 443 ssl http2; # managed by Certbot

# Enable HTTP Strict Transport Security (HSTS)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

Test Nginx configuration syntax and reload the web server daemon: sudo nginx -t && sudo systemctl reload nginx.

Troubleshooting Common Domain & SSL Issues

If you encounter unexpected errors during domain pointing or certificate issuance, consult these diagnostic solutions:

• Certbot DNS Validation Failures: Verify that both yourdomain.com and www.yourdomain.com point to your exact Oracle Public IP address before invoking Certbot.

• Firewall Blocking Port 80: Certbot requires port 80 to be open for ACME challenge validation. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.

• Cloudflare Proxy Conflicts: If using Cloudflare DNS with the Orange Cloud Proxy enabled, set Cloudflare SSL/TLS encryption mode to Full (Strict) after installing your Certbot certificate.

Frequently Asked Questions (FAQ)

Why does Certbot fail with "Connection Refused" or "Timeout"?
Certbot validates domain ownership via an ACME HTTP-01 challenge over port 80. If port 80 is blocked in your OCI VCN Security List or Linux iptables firewall, Certbot validation will fail. Ensure port 80 is publicly accessible.

Can I use Cloudflare Flexible SSL instead of Certbot?
Cloudflare Flexible SSL encrypts traffic strictly between the user browser and Cloudflare. Traffic between Cloudflare and your Oracle VPS remains unencrypted. Installing Certbot lets you use Cloudflare Full (Strict) mode, which encrypts the connection all the way to your server.

What happens if my Oracle Public IP Address changes?
Oracle Cloud Ephemeral Public IPs remain static as long as the instance stays running. To prevent IP changes during VM restarts, assign a free Reserved Public IP in the OCI Console under Networking > IP Management.

How do I fix SSL Mixed Content warnings?
Mixed content warnings occur when an HTTPS webpage requests unencrypted HTTP assets (images, scripts, or CSS files). Update your web application database or template paths to use relative URLs or explicit https:// prefixes.

How do I point multiple domains to the same Oracle Cloud VPS instance?
To host multiple websites or staging subdomains on a single Oracle Cloud instance, repeat Step 2 and Step 3 for each domain name. Create a separate Nginx server block in /etc/nginx/sites-available/ and run sudo certbot --nginx -d newdomain.com for each site.

Hardening SSL/TLS Security: Enforcing TLS 1.3, HSTS, and OCSP Stapling

Securing an SSL/TLS certificate from Let's Encrypt is only the first step. Default SSL configurations often leave legacy protocols enabled, lowering your SSL Labs grade and exposing client traffic to potential downgrade attacks. To achieve an A+ security rating and ensure lightning-fast SSL handshakes, configure modern TLS parameters inside your NGINX server block.

Edit your domain's NGINX configuration (/etc/nginx/sites-available/yourdomain.com) to enforce modern cipher suites and HTTP Strict Transport Security (HSTS):

# Modern TLS 1.2 and TLS 1.3 only
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

# Enable HTTP Strict Transport Security (HSTS)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# OCSP Stapling for faster SSL verification
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

Test your NGINX syntax and reload the web server to activate your hardened SSL configuration:

sudo nginx -t && sudo systemctl reload nginx

If your website experiences connection timeouts after applying SSL changes, ensure that port 443 is unblocked across both your cloud virtual network and local firewall using our detailed troubleshooting guide on opening ports 80 and 443 on cloud VPS instances. Additionally, discover how server microcaching speeds up dynamic PHP rendering in our guide to speeding up WordPress performance.

Prefer not to manage the server yourself? Compare RackUp’s hosting plans: Cloud WordPress hosting starts at $2.49 a month.

Automating Let's Encrypt Renewal with Systemd Timers & Cron

Let's Encrypt certificates are valid for exactly 90 days. While Certbot automatically installs a systemd renewal timer upon installation, server reboots or system updates can occasionally disable automated renewals. To make sure your SSL certificate never expires unnoticed, check your Certbot timer status:

# Check Certbot systemd timer status
sudo systemctl status certbot.timer

# Perform a dry-run renewal test
sudo certbot renew --dry-run

If the dry-run succeeds without errors, your automated certificate renewal pipeline is fully operational. To add an extra layer of protection, configure a pre-hook and post-hook that automatically reloads NGINX to apply newly generated cryptographic keys without interrupting live visitor traffic.

CAA DNS Records: Preventing Unauthorized SSL Certificate Issuance

In modern web security architecture, obtaining an SSL certificate is only half the battle. You must also prevent rogue or compromised Certificate Authorities from issuing fraudulent certificates for your domain. This is achieved by creating a Certification Authority Authorization (CAA) DNS record.

A CAA record is a specialized DNS record that explicitly declares which certificate authorities are authorized to generate cryptographic certificates for your domain name. To whitelist Let's Encrypt exclusively, add the following record to your DNS zone:

example.com. IN CAA 0 issue "letsencrypt.org"
example.com. IN CAA 0 issuewild "letsencrypt.org"

With this record in place, all other global certificate authorities are legally and technically prohibited from issuing certificates for your domain, shielding your online brand from man-in-the-middle impersonation attacks.

Configuring DNSSEC for Authenticated Domain Lookups

Along with HTTPS encryption, implementing Domain Name System Security Extensions (DNSSEC) provides end-to-end cryptographic verification of your domain name's DNS records. Without DNSSEC, attackers on compromised local networks or public Wi-Fi access points can execute DNS spoofing and cache poisoning attacks, tricking visitors' browsers into connecting to malicious replica servers even when the URL bar displays your real domain name.

By enabling DNSSEC at your domain registrar (such as Cloudflare Registrar, Namecheap, or GoDaddy) and adding DS (Delegation Signer) records to your authoritative nameservers, you cryptographically sign your DNS responses. This ensures that browsers verify the authentic IP address of your Oracle Cloud VPS before initiating the SSL handshake, establishing maximum trust for commercial e-commerce and lead generation websites.

Testing HTTPS Handshakes & Cipher Negotiation via OpenSSL

To independently verify that your custom domain is negotiating TLS 1.3 handshakes without protocol errors, execute a direct OpenSSL connection test from your local terminal:

# Test TLS 1.3 handshake and view certificate expiry details
openssl s_client -connect yourdomain.com:443 -tls1_3 -servername yourdomain.com

A successful handshake outputs Verify return code: 0 (ok) along with the issuer chain. This confirms that modern web browsers and Googlebot will experience instantaneous, encrypted SSL connections with zero security warnings.