Set up Let's Encrypt for your VPN server on a VPS

Using a custom domain and a Let's Encrypt certificate for a VPN server on a VPS ensures stable connections for 10-50 users, traffic obfuscation, and trusted TLS encryption, preventing client reconfiguration during IP address changes or blocks, with setup taking up to 30 minutes using Certbot.

Why a Custom Domain for Your VPN Server is Better Than an IP Address, and What is Trusted TLS?

Many users setting up a VPN on their own Virtual Private Server (VPS) for the first time start by connecting directly via an IP address. This is simple, fast, and seems logical. However, this approach has several significant drawbacks, especially concerning stable VPN operation for multiple users or in regions with active censorship. Using a custom domain and a Let's Encrypt certificate solves these issues, offering a much more reliable and flexible solution.

Improved Stability and User Experience: Why a Custom Domain Beats an IP for VPNs

Imagine your VPS provider changes the server's IP address (which is rare but happens) or, far more likely, your current IP address is blocked by an internet service provider in your region. In such a scenario, all your VPN users will find the service inoperable. If you have 5, 10, or 50 users, each one will have to manually change the IP address in their client configuration. This is time-consuming, inconvenient, and frustrating.

When your VPN server is tied to a domain name (e.g., myvpn.com), the situation changes dramatically. If the server's IP address is blocked or changes, you only need to update a single record in your domain's DNS settings, pointing to the new IP. After DNS propagation (which typically takes from a few minutes to several hours), all your users will automatically connect to the new IP using the old domain name, without requiring any changes to their client configurations. This is a critically important advantage for ensuring uninterrupted operation and convenience. You can find a detailed guide on creating and configuring a VPN on a VPS in our main article on VPN on your own VPS.

Traffic Obfuscation and Trust: The Role of an SSL Certificate for Your VPN Server

Modern VPN protocols, such as VLESS, Reality, Trojan, and Shadowsocks with TLS, actively use TLS encryption for traffic obfuscation. Without a TLS certificate, VPN traffic is easily identifiable as such, making it vulnerable to signature-based blocking. This is where an SSL certificate for your VPN server becomes crucial.

A TLS certificate issued by a trusted Certificate Authority (CA), such as Let's Encrypt, makes your VPN traffic indistinguishable from regular HTTPS traffic, for example, when browsing websites or using online services. This significantly hinders its blocking by Deep Packet Inspection (DPI) methods. Furthermore, using a Let's Encrypt certificate on a VPS for VLESS or other protocols provides:

• Trust: VPN client software (e.g., Xray, Sing-box, Nekoray) trusts Let's Encrypt certificates by default, as they are part of standard operating system root trust stores. This eliminates the need to install self-signed certificates, simplifying setup and enhancing security.
• Obfuscation: When your VPN server uses a domain and an SSL certificate, its traffic appears as regular web traffic to that domain. This is particularly effective in conjunction with protocols that mimic HTTPS, such as VLESS with WebSocket and TLS, or Reality.
• Security: TLS provides end-to-end encryption, protecting your traffic from interception and data tampering.

Without a domain and certificate, your VPN server, even if it uses TLS, will issue untrusted certificate warnings (if it's self-signed) or will be easily identifiable if TLS is absent entirely. For protocols like VLESS over Cloudflare CDN, a domain and TLS certificate are cornerstones of the architecture.

VPS Sizing for VPN: How Many Users Can Your Server Support?

For 50 concurrent users, a VPS with 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk is sufficient.

Users	vCPU	RAM	Disk	Network Port	Approx. Price ($/month)
1-5	1	1 GB	20 GB SSD	100 Mbps	$5-7
5-20	2	2 GB	40 GB SSD/NVMe	500 Mbps	$7-15
20-50	4	4-8 GB	80 GB NVMe	1 Gbps	$15-30
50-100+	6-8	8-16 GB	160+ GB NVMe	1-10 Gbps	$30-60+

Note that these are general recommendations. Actual load depends on user activity, the VPN protocol used, and other background processes on your VPS. For most users, especially in home settings or for small teams, a VPS with 2 vCPU and 2-4 GB RAM will be more than sufficient. Valebyte.com offers various VPS plans that are ideal for deploying VPN servers.

How to Choose and Register a Domain for Your VPN Server on a VPS

Choosing a domain name for your VPN server is an important step that affects ease of use and, potentially, resilience to blocking. Several factors should be considered.

Key Criteria for Choosing a VPN Domain Name

• Simplicity and Memorability: Choose a domain that is easy to remember and type. Short and clear names are always preferable.
• Neutrality: Avoid names that explicitly indicate "VPN" or "proxy" if you want to enhance obfuscation. A neutral name, such as myservice.online or securelink.net, appears like a regular website.
• TLD Availability: .com, .net, .org are universal Top-Level Domains (TLDs), but they can be more expensive and harder to find available names. Newer TLDs, such as .online, .tech, .xyz, .app, offer more options and are often cheaper. Ensure your chosen TLD is supported by all DNS providers and has no specific restrictions.
• Price: Domain prices can vary significantly from $5 to $50+ per year depending on the TLD and registrar.

Where to Register Your VPN Domain

There are many accredited domain name registrars. Here are a few popular options:

• Namecheap: Known for good pricing, free WhoisGuard (privacy protection), and a user-friendly interface.
• Cloudflare Registrar: Offers domains at wholesale prices without markup, but requires using their DNS servers. An excellent option if you plan to use Cloudflare CDN.
• GoDaddy: One of the largest registrars, offering a wide range of services, but can sometimes be more expensive.
• Regional Registrars: Some countries have their own major registrars that may offer local TLDs.

After choosing a registrar and a domain name, the registration process typically looks like this:

1. Go to the registrar's website.
2. Use the search function to check the availability of your chosen domain.
3. Add the domain to your cart and complete the order, following the instructions.
4. Pay for the registration. You will need to provide your contact details, which will be used for Whois information. It is recommended to use a WhoisGuard service (if not included) to protect your personal data from public access.

How to Link Your Domain to Your VPS and Configure DNS

After registering your domain, you need to link it to your VPS's IP address. This is done through DNS (Domain Name System) settings. DNS is like the internet's phone book, translating domain names into IP addresses.

Configuring DNS Records: A and AAAA

The primary DNS record you need to configure is an A record (Address record) for IPv4 or an AAAA record (Quad-A record) for IPv6. Most VPS providers, including Valebyte.com, provide at least one public IPv4 address. Some also offer IPv6.

1. Obtain your VPS IP address: This will be listed in your VPS provider's control panel.
2. Navigate to your DNS control panel: This could be your domain registrar's panel or a third-party DNS provider like Cloudflare.
3. Add an A record:
   • Name (Host): This is typically @ for the root domain (e.g., example.com) or a subdomain name (e.g., vpn for vpn.example.com).
   • Value (Value/Points to): Enter your VPS's IPv4 address.
   • TTL (Time To Live): The time in seconds that DNS servers should cache this record. For quick changes, you can set a low value (e.g., 300 seconds or 5 minutes), but for stable operation, 3600 or 14400 can be used.
4. (Optional) Add an AAAA record: If your VPS has an IPv6 address, repeat step 3, but select the AAAA record type and enter the IPv6 address.

Example DNS records for the domain myvpn.com, pointing to a VPS with IP 192.0.2.1:

Type   Name   Value       TTL
A      @      192.0.2.1   300
A      vpn    192.0.2.1   300

In this example, @ points to myvpn.com, and vpn points to vpn.myvpn.com. You can use any subdomain you find convenient.

Leveraging Cloudflare CDN for VPN Proxying and Obfuscation

Cloudflare is not just a CDN, but also a powerful DNS provider with security and proxying features. Using Cloudflare for your domain can significantly improve the obfuscation and resilience of your VPN server.

1. Change NS records: In your domain registrar's panel, specify Cloudflare's NS servers (e.g., anna.ns.cloudflare.com and denis.ns.cloudflare.com). This delegates DNS management to your Cloudflare account.
2. Configure the A record in Cloudflare: Add an A record as described above.
   • With proxying (orange cloud): If you enable Cloudflare proxying (orange cloud active), traffic to your domain will route through Cloudflare's servers. This hides your VPS's real IP address and can help bypass blocks, as traffic to your VPS will appear as traffic to Cloudflare. This is especially effective for protocols using WebSocket+TLS, such as VLESS. However, not all VPN protocols work well with Cloudflare proxying, as it can add latency and modify headers.
   • Without proxying (grey cloud): If you disable proxying (grey cloud), Cloudflare will act as a regular DNS provider, simply pointing to your IP address. This is suitable for most VPN protocols incompatible with proxying, while still benefiting from Cloudflare's fast DNS and DDoS protection.

For VLESS Reality protocols, using a custom domain and direct connection (without Cloudflare proxying) is often the optimal solution, as the Reality protocol itself provides excellent obfuscation. However, for VLESS over Cloudflare CDN, proxying is a key element.

After configuring DNS records, it will take some time (up to 24-48 hours, though usually faster) for them to propagate globally. You can check DNS propagation using tools like dnschecker.org.

Setting Up Let's Encrypt SSL Certificate for Your VPN Server on a VPS

Obtaining an SSL/TLS certificate from Let's Encrypt is a mandatory step to ensure the security and obfuscation of your VPN traffic. Let's Encrypt provides free, trusted certificates that are automatically accepted by all browsers and operating systems.

What is Let's Encrypt and Why is it Essential for Your VPN?

Let's Encrypt is a Certificate Authority (CA) that issues free SSL/TLS certificates. It has automated the certificate issuance process, making HTTPS accessible to everyone. For a VPN server, a Let's Encrypt certificate is critically important because:

• It provides trust: your VPN client will not issue untrusted connection warnings.
• It enables TLS encryption, which is the foundation for traffic obfuscation and protection against interception.
• It is integral to many modern VPN protocols, such as VLESS, Reality, and Trojan, to mimic regular HTTPS traffic.

Installing Certbot to Obtain Your Certificate

Certbot is the official Let's Encrypt client that automates the process of obtaining and installing certificates. To install Certbot on your VPS (assuming Debian/Ubuntu or CentOS/RHEL is used), follow these steps.

For Debian/Ubuntu:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y # If you are using Nginx
# Or sudo apt install certbot python3-certbot-apache -y # If you are using Apache
# Or sudo apt install certbot -y # For standalone or webroot methods

For CentOS/RHEL:

sudo dnf install epel-release -y
sudo dnf install certbot python3-certbot-nginx -y # If you are using Nginx
# Or sudo dnf install certbot python3-certbot-apache -y # If you are using Apache
# Or sudo dnf install certbot -y # For standalone or webroot methods

Ensure you have Nginx or Apache installed if you plan to use their Certbot plugins. If not, you can obtain a certificate using the standalone or webroot methods.

Obtaining Your Certificate Using Certbot

There are several ways to obtain a certificate using Certbot:

1. Using the Nginx/Apache Plugin (Recommended if you have a web server)

If your VPS already has Nginx or Apache installed and configured for your domain, Certbot can automatically set it up and obtain a certificate. Ensure your domain already points to your VPS's IP and the web server is responding on port 80.

sudo certbot --nginx -d your_domain.com -d www.your_domain.com
# Or sudo certbot --apache -d your_domain.com -d www.your_domain.com

Certbot will ask a few questions: your email (for expiration notifications), and agreement to the terms of service. If successful, it will automatically configure Nginx/Apache to use HTTPS and issue the certificate.

2. Using the Standalone Method

This method temporarily runs Certbot's built-in web server on port 80 for verification. This is useful if you don't have Nginx/Apache or prefer Certbot not to modify them. Before using, ensure port 80 is free (stop Nginx/Apache if they are running).

sudo systemctl stop nginx # If Nginx is running
sudo certbot certonly --standalone -d your_domain.com
sudo systemctl start nginx # Start Nginx back up

The certificate will be issued to the directory /etc/letsencrypt/live/your_domain.com/. You will need the fullchain.pem and privkey.pem files to configure your VPN server.

3. Using the Webroot Method

This method requires you to have a running web server that can serve files from a specific directory (webroot). Certbot will place a challenge file in this directory, and Let's Encrypt will verify it via HTTP.

sudo certbot certonly --webroot -w /var/www/html -d your_domain.com

Replace /var/www/html with the actual path to your web server's root directory.

After obtaining the certificate, you will see a success message and the paths to the certificate files. They are typically located in /etc/letsencrypt/live/your_domain.com/.

/etc/letsencrypt/live/your_domain.com/fullchain.pem  # Full certificate chain
/etc/letsencrypt/live/your_domain.com/privkey.pem   # Private key

These paths are used when configuring VPN servers, such as Xray-core or Sing-box, for TLS support. For example, an Xray-core configuration might look like this:

{
  "inbounds": [
    {
      "port": 443,
      "protocol": "vless",
      "settings": {
        "clients": [
          {
            "id": "YOUR_UUID",
            "level": 0
          }
        ],
        "decryption": "none"
      },
      "streamSettings": {
        "network": "ws",
        "security": "tls",
        "tlsSettings": {
          "alpn": ["http/1.1"],
          "certificates": [
            {
              "certificateFile": "/etc/letsencrypt/live/your_domain.com/fullchain.pem",
              "keyFile": "/etc/letsencrypt/live/your_domain.com/privkey.pem"
            }
          ]
        },
        "wsSettings": {
          "path": "/your_path"
        }
      }
    }
  ]
}

More detailed instructions on configuring VLESS Reality with Xray-core can be found in the article Self-Hosted VPN on VPS: VLESS Reality + Xray-core in 10 Minutes.

Certbot Auto-Renewal: Ensuring Continuous VPN Server Operation

Let's Encrypt certificates are issued for 90 days. This is done to enhance security but requires regular renewal. Fortunately, Certbot includes an auto-renewal mechanism that ensures your VPN server's SSL certificate is always up-to-date.

Configuring Automatic Certificate Renewal

Certbot by default installs a systemd timer or cron job for automatic certificate renewal. This runs twice a day, and if a certificate is nearing expiration (typically within 30 days), Certbot attempts to renew it.

Checking Auto-Renewal Status:

sudo certbot renew --dry-run

This command simulates the renewal process without making actual changes. If you see messages about successful "dry" renewals for all your domains, then auto-renewal is working correctly. If there are errors, Certbot will report them.

Auto-Renewal Mechanism:

• Systemd Timer (for most modern Linux systems): Certbot installs a certbot.timer unit file that runs certbot.service (executing certbot renew) twice a day.

  
          sudo systemctl status certbot.timer
          

  If the timer is not active, you can enable it:

  
          sudo systemctl enable certbot.timer
          sudo systemctl start certbot.timer
          

• Cron Job (for older systems or if systemd is not used): In some cases, Certbot may add an entry to cron. You can check this by viewing the cron file:

  
          sudo cat /etc/crontab
          # Or sudo crontab -l
          

  Look for a line similar to 0 */12 * * * root /usr/bin/certbot renew.

Certbot Hooks for Restarting Your VPN Server

After a successful certificate renewal, your VPN server needs to "know" about it to start using the new certificate files. Most VPN servers do not hot-reload certificates, so a service restart is required. Certbot allows you to add "hooks" (post-hook) — commands that will be executed after a successful renewal.

Edit the Certbot configuration file for your domain (e.g., /etc/letsencrypt/renewal/your_domain.com.conf) and add a post_hook line:

# /etc/letsencrypt/renewal/your_domain.com.conf
# ...
[renewalparams]
authenticator = nginx
installer = nginx
# ...
post_hook = systemctl reload nginx && systemctl restart xray # Example for Nginx and Xray-core
# Or post_hook = systemctl restart sing-box # Example for Sing-box

Replace systemctl restart xray or systemctl restart sing-box with the command that restarts your VPN server. If you are using Nginx as a frontend for VLESS/WebSocket, reloading Nginx (systemctl reload nginx) is sufficient, as it will update certificates without a full restart.

Using Certbot for automatic certificate renewal is a key element for the stable operation of your VPN server, especially for protocols like sing-box on VPS, which actively use TLS.

Custom Domains for VLESS and Other VPN Protocols: Practical Scenarios and Obfuscation

The application of a custom domain and TLS certificate extends far beyond simple IP binding. It forms the foundation for advanced obfuscation techniques and bypasses, especially relevant for VLESS and Reality protocols.

VLESS with WebSocket and TLS: Mimicking HTTPS Traffic

The VLESS protocol in conjunction with WebSocket and TLS (WSS) is one of the most popular and resilient VPN solutions. It uses TLS encryption to make traffic indistinguishable from regular HTTPS traffic. The domain plays a central role here:

1. Server Identification: The VLESS client connects to a domain, not an IP address. This allows the use of CDNs like Cloudflare to proxy traffic and hide the real IP address of the VPS.
2. TLS Handshake: Upon connection establishment, a standard TLS handshake occurs using the Let's Encrypt certificate issued for your domain. This creates the illusion of a regular HTTPS connection to a website.
3. WebSocket: After a successful TLS handshake, a WebSocket connection is established within the TLS tunnel, through which VLESS traffic is transmitted. WebSocket is also a standard web protocol, further enhancing obfuscation.

To configure such a server, Nginx is often used as a reverse proxy, which accepts incoming connections on port 443, handles TLS, and then forwards WebSocket traffic to the internal port of Xray-core or Sing-box. In this way, your VPN server appears as a regular web server serving HTTPS traffic over a domain, which significantly reduces the likelihood of detection and blocking by DPI systems.

Reality Protocol: Advanced Obfuscation Without a CDN

Reality is an innovative protocol developed for Xray-core that provides an unprecedented level of obfuscation without using a CDN. It works by making your VPN server appear as an existing, popular website (e.g., microsoft.com, google.com). To achieve this, Reality uses its own TLS handshake mechanism that mimics the handshake of the target site.

Even with Reality, a custom domain for VLESS is still important. Although the primary traffic is obfuscated to appear as another site, your own domain can be used for:

• Additional Services: On the same VPS, you can host a small website or other services that will use your domain, enhancing the server's legitimacy.
• Fallback: If Reality fails for some reason, you can always switch to VLESS+WS+TLS using your own domain and Let's Encrypt certificate.
• Management: The convenience of managing and updating the IP address via DNS remains relevant.

For setting up VLESS Reality + Xray-core in 10 minutes, we recommend checking out this article.

Recommendations for Enhancing VPN Obfuscation

1. Use a lesser-known domain: The less known your domain, the less likely it is to be on blacklists.
2. Host a simple website: You can host a simple static website (e.g., "Hello World" or a placeholder page) for your domain on port 80/443. This makes your server appear even more like a regular web server.
3. Use different domains for different users/protocols: If you have many users or are experimenting with various protocols, consider using multiple subdomains or even different domains.
4. Regularly change domains: In conditions of strict censorship, quickly changing your domain may be a necessary measure.

What to Do When Your VPN Domain is Blocked: Quick Replacement and Resilience Strategies

Even with the most thorough obfuscation, in conditions of active censorship, there is a risk of the domain name used for your VPN server being blocked. However, having a custom domain significantly simplifies the recovery process compared to an IP address block.

Signs Your VPN Domain Might Be Blocked

• Users are unable to connect to the VPN via the domain name.
• Checking the domain via ping or nslookup from the blocked region yields no response or points to the IP address of a blocking entity.
• Access to the domain via a browser is also blocked.

Quick Domain Replacement: A Step-by-Step Guide

The advantage of using a domain is that if it gets blocked, you don't need to change your VPS's IP address or reconfigure the server itself. Simply replacing the domain name is sufficient.

1. Register a new domain: It's advisable to have several backup domains registered in advance or be ready to quickly acquire a new one. Choose domains with different TLDs to avoid a blanket block.
2. Configure DNS for the new domain: Link the new domain (or subdomain) to your existing VPS's IP address, as described in the "Configuring DNS Records" section. Set a low TTL (e.g., 300 seconds).
3. Issue a Let's Encrypt certificate for the new domain: Use Certbot to obtain a certificate for the new domain. If you are using Nginx as a frontend, ensure the new domain is added to its configuration.

   
           sudo certbot --nginx -d new_domain.com
           

   If you are already using Nginx with multiple domains, simply add the new domain to an existing certificate or obtain a new one using the --expand option.

4. Update your VPN server configuration: Change the domain name in your VPN server's configuration (Xray-core, Sing-box, etc.) to the new domain.

   
           # Example for Xray-core
           # ...
           "host": "new_domain.com",
           # ...
           "certificateFile": "/etc/letsencrypt/live/new_domain.com/fullchain.pem",
           "keyFile": "/etc/letsencrypt/live/new_domain.com/privkey.pem"
           # ...
           

5. Restart your VPN server: After updating the configuration, restart the VPN service so it starts using the new domain and certificate.

   
           sudo systemctl restart xray # Or sing-box, or your_service
           

6. Distribute new configs to users: Inform users of the new domain and, if necessary, provide updated configuration files. Since the VPS IP address remains the same, changes to the configs are minimal.

Strategies for VPN Block Resistance

• Use multiple domains/subdomains: Have several domains or subdomains pointing to the same VPS. If one is blocked, you can quickly switch to another.
• CDN fronting (Cloudflare): As mentioned, Cloudflare can hide your VPS's real IP address. If a domain is blocked, you can quickly change it in Cloudflare without changing the server's IP. This is effective for VLESS+WS+TLS. However, Cloudflare itself can also be blocked in some regions.
• Utilize SNI routing: Some protocols, such as Reality, use SNI (Server Name Indication) to masquerade as another website. This makes blocking by domain name more difficult, as your server appears to be a large resource.
• Regular monitoring: Monitor the availability of your domain from different regions. VPN server monitoring tools on VPS will help you quickly identify issues.
• Backup VPS: In the most extreme cases, if not only domains but also IP addresses of entire data centers are blocked, a backup VPS in a different location may be required. Valebyte.com offers VPS in various geographical locations, allowing you to choose the most block-resistant region.

For users in regions where censorship is particularly aggressive, it's important to understand that root certificates and protocols may be under special scrutiny. Refer to the article VPS for Kazakhstan: Root Certificate, Blocks, and Working Protocols for a deeper understanding.

Frequently Asked Questions

Can I use a free domain for a VPN server?

Yes, theoretically you can, but it is not recommended for critical VPN servers. Free domains are often less reliable, may have DNS configuration limitations, and are easier to block or revoke, which will lead to disruptions in your VPN's operation. An investment of $5-10 per year for a reliable domain pays off in stability and confidence.

Do I need to install a web server (Nginx/Apache) for Let's Encrypt?

Not necessarily. While installing Nginx or Apache simplifies the process with Certbot thanks to their plugins, you can obtain a certificate using Certbot's --standalone method. In this case, Certbot will temporarily run its own web server on port 80 for domain verification. After the certificate is obtained, this web server will be stopped, and port 80 will be freed for other uses. For VLESS with Reality, a web server is not needed, but for VLESS+WS+TLS, Nginx is often used as a frontend.

How often do I need to renew a Let's Encrypt certificate?

Let's Encrypt certificates are issued for 90 days. However, thanks to Certbot and its automatic renewal mechanism (via systemd timer or cron job), you don't need to do this manually. Certbot automatically checks certificate validity twice a day and renews them if they are less than 30 days from expiration. This ensures continuous operation of your VPN server without manual intervention.

What if my VPS doesn't have IPv6, but I want to use a domain?

This is perfectly normal. Most VPN servers and clients use IPv4 by default. If your VPS only has an IPv4 address, you only need to create an A record in DNS pointing to your IPv4 address. All modern DNS servers and VPN clients work correctly with IPv4 only. Having IPv6 is a nice addition but not a mandatory requirement for VPN functionality with a domain.

Can I use a single domain for multiple VPN servers?

Yes, you can use a single root domain with different subdomains for multiple VPN servers. For example, vpn1.myvpn.com for a server in Germany and vpn2.myvpn.com for a server in the USA. Each subdomain will have its own A record pointing to the corresponding VPS IP address and its own Let's Encrypt certificate. This is a convenient way for centralized management, especially if you use multiple Valebyte.com VPS instances in different locations.

Conclusion

Using a custom domain and a Let's Encrypt certificate is not just a "good practice" but a fundamental requirement for creating a stable, secure, and block-resistant VPN server on a VPS. This provides convenience for end-users, reliable traffic obfuscation, and the ability to quickly adapt to IP address changes or blocks. An investment of $5-10 per year for a domain and 30 minutes for Certbot setup will pay off many times over, ensuring the uninterrupted operation of your VPN service.