"Setting up SSL for OpenClaw doesn't have to be intimidating. With modern ACME clients and a few terminal commands, you can have a fully encrypted deployment in under 15 minutes—and keep it that way with automated renewals."
Prerequisites
- A Hostinger VPS running Ubuntu 22.04 or Debian 12
- OpenClaw installed and listening locally (e.g., on port 3000)
- A domain name pointing to your VPS's public IP (e.g., openclaw.yourdomain.com)
- SSH access with sudo privileges
- Ports 80 (HTTP) and 443 (HTTPS) open in the firewall
Hostinger VPS note: For OpenClaw projects, the 2‑vCPU / 4 GB‑RAM KVM plan is a good starting point. It provides enough headroom for the agent, reverse proxy, and a few side‑services. Check current Hostinger VPS pricing.
Method 1: SSL with Nginx and Certbot (Most Flexible)
Step 1: Install Nginx and Certbot
sudo apt update sudo apt install nginx certbot python3-certbot-nginx -y
Step 2: Create Nginx Configuration
Edit a new file at /etc/nginx/sites-available/openclaw:
server {
listen 80;
server_name openclaw.yourdomain.com;
location / {
proxy_pass http://localhost:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}
}
Step 3: Enable the Site and Test
sudo ln -s /etc/nginx/sites-available/openclaw /etc/nginx/sites-enabled/ sudo nginx -t # Should return "syntax is ok" sudo systemctl reload nginx
Step 4: Obtain SSL Certificate
sudo certbot --nginx -d openclaw.yourdomain.com
Follow the prompts, and Certbot will automatically modify your Nginx config to use HTTPS.
Pitfall: If your domain doesn't resolve yet, Certbot will fail. Make sure DNS propagation is complete before running this command.
Step 5: Verify Auto‑Renewal
sudo systemctl status certbot.timer sudo certbot renew --dry-run
Method 2: SSL with Caddy (Zero‑Configuration)
Step 1: Install Caddy
sudo apt update sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https curl curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list sudo apt update sudo apt install caddy -y
Step 2: Configure Caddy
Edit /etc/caddy/Caddyfile:
openclaw.yourdomain.com {
reverse_proxy localhost:3000
}
Step 3: Start Caddy
sudo systemctl reload caddy
Caddy will automatically obtain and renew a Let's Encrypt certificate on first request.
Important: Caddy requires port 80 and 443 to be free. If Nginx or another web‑server is already using them, stop it first with sudo systemctl stop nginx.
Common SSL Issues & Troubleshooting
1. Port 80/443 Blocked
If using UFW:
sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw reload
2. DNS Not Propagated
Check with:
dig openclaw.yourdomain.com +short ping -c 3 openclaw.yourdomain.com
3. Certificate Renewal Fails
Check logs:
sudo journalctl -u certbot --since "1 hour ago" -f sudo journalctl -u caddy --since "1 hour ago" -f
4. Mixed Content Warnings
Ensure OpenClaw's internal URLs use HTTPS. Check browser console for HTTP resources.
Maintenance Checklist
- ✅ Monitor certificate expiry:
sudo certbot certificates - ✅ Keep ACME client updated:
sudo apt update && sudo apt upgrade certbot - ✅ Test renewal monthly:
sudo certbot renew --dry-run - ✅ Backup SSL configs and private keys
- ✅ Check firewall rules after VPS reboots
Why a Hostinger VPS for OpenClaw?
Hostinger's KVM‑based VPS plans offer a good balance of price, performance, and ease‑of‑use for self‑hosting projects like OpenClaw:
- Full root access for custom SSL/TLS configuration
- Stable network and uptime for certificate renewals
- One‑click OS reinstall if you need to start over
- IPv4 address included (required for Let's Encrypt)
- Competitive pricing for low‑to‑mid‑range specs
Getting started: If you're new to VPS hosting, Hostinger's VPS plans come with a straightforward control panel and detailed setup guides. The 4 GB‑RAM tier is usually sufficient for OpenClaw plus a reverse proxy and monitoring.
FAQ
Which SSL certificate is best for OpenClaw on a Hostinger VPS?
Let's Encrypt is the recommended choice for personal and small‑scale OpenClaw deployments. It's free, automated, and supported by widely used ACME clients like Certbot, acme.sh, or built into modern web servers like Caddy.
Do I need a dedicated domain for OpenClaw SSL?
Yes, Let's Encrypt requires a publicly resolvable domain name (e.g., openclaw.yourdomain.com) that points to your VPS IP. You cannot obtain a certificate for a bare IP address or a non‑public hostname.
Can I use a wildcard certificate for OpenClaw subdomains?
Yes, wildcard certificates (e.g., *.yourdomain.com) are supported by Let's Encrypt with DNS‑01 verification. This is useful if you plan to run multiple OpenClaw instances or expose different services under the same domain.
What's the easiest reverse proxy setup for SSL with OpenClaw?
Caddy is the simplest option—it automatically obtains and renews Let's Encrypt certificates with a minimal configuration. For more control and familiarity, Nginx with Certbot is a solid choice. Both work well on Hostinger's Ubuntu/Debian VPS images.
How do I automate SSL renewal for OpenClaw?
Most ACME clients include automatic renewal. Certbot sets up a systemd timer by default. Caddy handles it internally. You can also add a cron job to run certbot renew weekly. Remember to reload your web‑server config after renewal.
What's the most common SSL setup mistake on a VPS?
Not opening port 80 for HTTP‑01 verification. Let's Encrypt needs to reach your server on port 80 (for HTTP‑01) or 443 (for TLS‑ALPN‑01). If you've blocked those ports or misconfigured firewall rules, certificate issuance will fail.