How to Get a Free SSL Certificate with Certbot

Every site should be served over HTTPS, and thanks to Let's Encrypt it costs nothing. Certbot is the tool that fetches and renews free certificates automatically. This guide installs Certbot on Ubuntu 24.04 and secures a site behind Nginx or Apache, with renewal handled for you.

What you need first

• A domain with its A (and ideally AAAA) record pointing at your server — see how to point a domain to your VPS.
• A running web server. This guide assumes Nginx or Apache with a server block for your domain already answering on port 80.
• Ports 80 and 443 open in the firewall (sudo ufw allow 'Nginx Full').

Let's Encrypt validates that you control the domain by reaching your server over port 80, so DNS and the firewall must be right before you start.

Install Certbot

The recommended install path on Ubuntu is the plugin that matches your server. For Nginx:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

For Apache, install python3-certbot-apache instead.

Get the certificate (Nginx)

Certbot can read your Nginx config, obtain the certificate, and rewrite the server block to use it — all in one command:

sudo certbot --nginx -d example.com -d www.example.com

You will be asked for an email (for expiry warnings) and to agree to the terms. Certbot then edits your server block to listen on 443 with the certificate and, if you choose, adds an automatic HTTP-to-HTTPS redirect. Say yes to the redirect.

Get the certificate (Apache)

The Apache flow is identical in spirit:

sudo certbot --apache -d example.com -d www.example.com

Verify auto-renewal

Let's Encrypt certificates last 90 days, so renewal must be automatic — and Certbot sets this up on install via a systemd timer. Confirm the timer is active and test a dry run:

systemctl status certbot.timer
sudo certbot renew --dry-run

If the dry run succeeds, real renewals will too. Certbot renews when a certificate is within 30 days of expiry, so there is nothing to schedule yourself.

Check your certificate

Confirm HTTPS works by visiting https://example.com, or from the command line:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

That prints the not-before and not-after dates so you can see the validity window.

Wildcard and DNS challenges

For a wildcard certificate (*.example.com) you must use the DNS-01 challenge, which proves control by adding a TXT record instead of answering on port 80:

sudo certbot certonly --manual --preferred-challenges dns -d '*.example.com'

This is handy when you run many subdomains, or when port 80 is not reachable. For automated DNS challenges you would add a provider plugin.

Harden your TLS configuration

Certbot gives you a valid certificate, but you can raise your security grade further. Certbot installs a recommended options file — make sure your server block includes it — then add HSTS so browsers refuse to connect over plain HTTP in future. In the server's 443 block:

    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

Only add HSTS once you are confident HTTPS works for every subdomain, because browsers will remember and enforce it. Check the negotiated protocol and cipher from the command line:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | grep -E 'Protocol|Cipher'

Modern Nginx defaults already prefer TLS 1.2 and 1.3 and disable the broken older protocols, so with HSTS added you are in strong shape without extra tuning.

FAQ

Are Let's Encrypt certificates as good as paid ones?

For encryption and browser trust, yes — they are domain-validated certificates trusted by all major browsers. Paid certificates mainly add organisation validation and warranties that most sites do not need. See our take on free SSL for a custom domain.

Why does Certbot fail to validate my domain?

Almost always DNS or firewall: the domain's A record is not pointing at this server yet, or port 80 is blocked. Confirm with dig +short example.com and sudo ufw status, then retry.

Do I need to renew manually every 90 days?

No. Certbot installs a systemd timer that renews automatically. Verify it with sudo certbot renew --dry-run and forget about it.

Can I use Certbot without editing my web server config?

Yes — use certbot certonly to obtain the certificate files only, then reference them in your server block yourself. This suits custom setups or servers Certbot has no plugin for. If you would rather avoid Certbot entirely, Caddy gets HTTPS automatically.

Nxeon VPS plans give you full root to run Certbot and serve every site over HTTPS on fast NVMe — with free migration help if you are moving a site and its certificates across. See also our broader security approach.