SSL & HTTPS
Free SSL Certificate with Let's Encrypt (Certbot)
Get a free, trusted, auto-renewing SSL certificate for your domain in under 5 minutes.
Published Mar 5, 2025Updated Jun 5, 20265 min readBeginner
Table of Contents
Prerequisites
- A domain name with an A record pointing to your server's IP
- Ports 80 and 443 open:
ufw allow 80/tcp && ufw allow 443/tcp - Nginx or Apache installed and running
Install Certbot
apt update
apt install certbot python3-certbot-nginx -yObtain a Certificate (Nginx — Recommended)
certbot --nginx -d yourdomain.com -d www.yourdomain.comCertbot will automatically:
- Verify domain ownership via HTTP challenge
- Issue a certificate from Let's Encrypt
- Edit your Nginx config to enable HTTPS
- Set up a permanent HTTP → HTTPS redirect
Obtain a Certificate (Apache)
apt install python3-certbot-apache -y
certbot --apache -d yourdomain.com -d www.yourdomain.comWildcard Certificate (all subdomains)
certbot certonly --manual --preferred-challenges dns -d "*.yourdomain.com" -d yourdomain.comYou'll need to add a TXT DNS record to prove ownership. Useful for api.yourdomain.com, app.yourdomain.com, etc.
Verify Auto-Renewal
certbot renew --dry-runCertbot installs a systemd timer that auto-renews certificates 30 days before expiry. You don't need to do anything manually.
Check Certificate Details
certbot certificatesForce Renew (if needed)
certbot renew --force-renewal💡 Let's Encrypt certificates are valid for 90 days but always auto-renewed at 60 days. This is by design — frequent rotation is a security best practice.
SSLHTTPSLet's EncryptCertbot
Was this article helpful?
