1. Point DNS A record to the VPS.
2. Install Certbot for Nginx or Apache.
3. Run certbot and follow prompts.
4. Auto-renewal is usually configured.
HTTP-01 challenges need port 80 reachable.