Certbot: Let's Encrypt (free SSL certificates)

It's really quite simple. You just install Certbot and you can get free SSL certificates from Let's Encrypt.

apt install certbot python3-certbot-apache -y
certbot --apache -d your-domain.com -d www.your-domain.com

The Apache plugin (--apache) handles both domain validation and setting up the SSL vHost configuration in one step. On the first run you have to enter an email address and accept the license terms with A.

The certificates are only valid for 90 days. Certbot automatically sets up a systemd timer (certbot.timer) for renewal during installation. You can verify it like this:

systemctl list-timers certbot.timer
certbot renew --dry-run

A manual renewal is only needed in an emergency:

certbot renew