SoftEtherVPN server creates a self-signed TLS certificate during the installation process, but we will use Let’s Encrypt certificate. The advantage of using Let’s Encrypt certificate is that it’s free, easier to set up, and trusted by VPN client software.

• Run the following commands to install Let’s Encrypt client (certbot) from the default Ubuntu repository:

sudo apt install certbot

• Check the version number, run:

certbot --version

• Use the standalone to obtain TLS certificate (if SoftEther VPN server will use port 443, no Webserver installed):

sudo certbot certonly --standalone --preferred-challenges http --agree-tos --key-type rsa --email you@example.com -d vpn.example.com