SSL Certificates
Secure connections between visitors and your site
HTTPS and SSL on Arcustech VPS
SSL encrypts traffic, protects logins and forms, and improves user trust and browser security indicators.
Our recommended modern setup: Put a CDN and abuse protection service in front of your site (Cloudflare, Bunny CDN, Fastly, etc.). This improves global performance, reduces bot and abuse traffic, and also handles SSL for visitors at the edge.
If you do not want a CDN, we recommend Let’s Encrypt on the server using DNS validation with automated renewal.
Updated: July 2026
Why the SSL industry is changing
The maximum validity period for publicly trusted SSL/TLS certificates is being reduced on a phased schedule. This is pushing the industry toward automated issuance and renewal, similar to what Let’s Encrypt has been doing for years.
- March 15, 2026: maximum certificate lifespan reduces to 200 days
- March 15, 2027: maximum certificate lifespan reduces to 100 days
- March 15, 2029: maximum certificate lifespan reduces to 47 days
The practical takeaway is simple: manual, calendar-based certificate renewals become increasingly difficult to maintain as certificate lifespans shorten.
Commercial SSL transition policy
Due to the SSL industry's move toward much shorter certificate lifespans, Arcustech is no longer selling commercial SSL certificates directly. We recommend either Let’s Encrypt with automated renewal or a CDN-managed SSL solution for nearly all websites.
Customers who already use a commercial Certificate Authority may continue to purchase certificates directly from the CA or SSL vendor of their choice. We will continue to install customer-provided, manually issued commercial SSL certificates at our current No Fee installation cost through March 14, 2027.
Between March 15, 2026 and March 14, 2027, commercial SSL certificates may still be sold by a CA or vendor as a yearly product, but each certificate actually issued may only be valid for up to 200 days. This may require the customer to obtain and provide a newly issued certificate for installation at least one additional time during the same yearly purchase period.
Beginning March 15, 2027, we will no longer support the routine manual installation and renewal of commercial SSL certificates. At that point, publicly trusted certificates will have a maximum validity period of only 100 days, making manual renewals impractical. Commercial SSL certificates will need to use automated issuance and renewal through an ACME-compatible Certificate Authority.
Our default SSL approach going forward
Option 1: Use a CDN (recommended)
We strongly recommend putting a CDN and abuse protection service in front of every website. Cloudflare is the most common choice, and its free tier is enough for most sites.
- SSL termination at the CDN: visitors connect to the CDN over HTTPS
- Abuse protection and caching: reduces load on your VPS and improves global performance
- Origin SSL to your server: you can use either a Let’s Encrypt certificate on the VPS or a long-lived CDN Origin Certificate
Option 2: Let’s Encrypt on the server (standard)
Let’s Encrypt is a free, automated certificate authority operated by the non-profit Internet Security Research Group (ISRG). Let’s Encrypt is our standard on-server SSL solution because it is designed for automation and scales cleanly as certificate lifespans shorten.
Our preferred Let’s Encrypt setup is DNS validation using a CNAME record. This allows us to issue a single wildcard certificate that covers both example.com and *.example.com, including www, staging, and other subdomains, with automated renewals.
- Wildcard by default: we typically issue example.com and *.example.com together
- Can be done before DNS cutover: DNS validation does not require the domain to point at the server yet
- Validation-only CNAME: the CNAME record is used only for certificate validation and does not route visitor traffic to Arcustech
To enable Let’s Encrypt on your VPS, open a support request in the Dashboard and tell us the domain name you want covered. We will provide a simple CNAME record to add at your DNS provider for validation and renewal.
If DNS validation is not an option, for example due to DNS restrictions or internal policy, we can still issue Let’s Encrypt using HTTP-based validation. In that case the certificate is non-wildcard, covering example.com and www.example.com by default, and the domain must be pointed to the web server during setup so the HTTP challenge can complete.
We recommend that customers monitor SSL expiration independently. Let’s Encrypt maintains a list of monitoring options here: SSL certificate monitoring options.
Option 3: Customer-provided Commercial SSL with ACME Automation (Limited Support)
If your organization has a strict compliance or enterprise policy that requires a commercial Certificate Authority, you may purchase certificates directly from the CA of your choice. If that CA supports ACME and provides the required ACME account credentials, including EAB credentials where required, we can often automate certificate issuance and renewal on your VPS.
One-time automation fee: $249 per SSL automation setup, per domain or certificate task.
Important: ACME is a standard protocol, but each commercial CA's account, billing, validation, and certificate issuance workflow may be different. Billing, account renewals, organization validation, and other CA-side requirements remain managed through your commercial CA account and are not managed through the Arcustech Dashboard. We can automate the supported on-server ACME workflow, but we cannot replace the CA's account management or support.
Our automation is based on acme.sh. If a specific CA requires unusual steps, custom validation methods, proprietary software, or non-standard behavior, we may either:
- require additional billable time due to the complexity of the setup, or
- determine that we cannot support reliable automation for that CA on our platform
If you are unsure which path fits your project, open a ticket and tell us whether you are using a CDN, Let’s Encrypt, or a commercial Certificate Authority, and we will point you to the best available option.
Additional Details:
Can I purchase an SSL certificate from Arcustech?
Arcustech no longer sells commercial SSL certificates directly. You may use Let’s Encrypt, a CDN-managed certificate, or purchase a commercial SSL certificate directly from the Certificate Authority or SSL vendor of your choice.
Through March 14, 2027, we will continue to install customer-provided, manually issued commercial SSL certificates at our current No Fee installation cost.
Our recommended solution for most websites is either a CDN-managed SSL certificate or Let’s Encrypt with automated renewal.
Does the validation CNAME affect my website traffic?
No. The DNS CNAME record used for Let’s Encrypt validation is only used to prove domain control to the certificate authority. It does not route website traffic, change where your site is hosted, or impact your normal DNS records.
Can SSL be set up before I move my DNS to Arcustech?
Yes. When using DNS validation, we can issue the certificate before your domain points to the new server.
This allows SSL to already be working when you perform the DNS cutover.
If DNS validation is not available for your DNS provider or organization, we can also install an existing SSL certificate before the cutover if you already have the certificate files.
Through March 14, 2027, this includes customer-provided commercial certificates or existing Let’s Encrypt certificates, as long as you provide the required files, such as the .crt certificate file and matching .key private key.
Once DNS is moved to the Arcustech server, the certificate will already be active and visitors will immediately connect using HTTPS.
Is it recommended to use SSL on my whole site?
Yes. HTTPS should be enforced site-wide whenever possible. It improves privacy and security for visitors and is the modern baseline expectation for browsers.
Can I have SSL on multiple domains on a single VPS?
Yes. This is typically handled using multiple certificates through SNI, or Server Name Indication, which is supported by all modern browsers. A CDN in front of the site can also simplify multi-domain SSL management.
Do you monitor SSL expirations for customers?
No. SSL certificate monitoring is not included as a managed service responsibility. If monitoring is important for your organization, we recommend using an external monitoring tool. Let’s Encrypt maintains a list of options here: monitoring options.