Knowledgebase

This guide covers installing Certbot and obtaining free Let's Encrypt SSL certificates on AlmaLinux/Rocky Linux, for both Nginx and httpd (Apache).

Prerequisites

• AlmaLinux 9 or Rocky Linux 9 VPS
• Nginx or httpd already installed and serving your domain over HTTP
• A domain with DNS pointing to your VPS

Step 1 — Enable EPEL

sudo dnf install epel-release -y

Step 2 — Install Certbot

For Nginx:

sudo dnf install certbot python3-certbot-nginx -y

For httpd:

sudo dnf install certbot python3-certbot-apache -y

Step 3 — Allow HTTP/HTTPS Through firewalld

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

Step 4 — Confirm DNS Points to This Server

dig +short yourdomain.com

Step 5 — Request and Install the Certificate

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For httpd:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Step 6 — Verify HTTPS

https://yourdomain.com

Step 7 — Test Automatic Renewal

sudo certbot renew --dry-run

Step 8 — Verify the Renewal Timer Is Active

sudo systemctl list-timers | grep certbot

Certbot's RPM package on AlmaLinux/Rocky Linux typically installs a systemd timer for automatic renewal, similar to the Ubuntu/Debian package.

SELinux Considerations

Certificate files under /etc/letsencrypt/ generally receive the correct SELinux context automatically when Certbot's Nginx/Apache plugin configures them. If you manually reference certificate paths in a custom configuration and encounter permission issues:

sudo ausearch -m avc -ts recent | grep nginx

Manually Configuring a Certificate (If Not Using the Plugin)

sudo certbot certonly --nginx -d yourdomain.com

Then reference the certificate paths manually in your server block:

ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;

Common Errors

"Could not bind to port 80" — confirm the firewalld rule for HTTP was added and no other service is already using the port.

Challenge fails — verify DNS actually resolves to this server's IP, and that firewalld permits inbound port 80 traffic from the internet.

Renewal fails silently — check the systemd timer status and Certbot's own logs:

sudo journalctl -u certbot-renew.timer

Best Practices

• Always confirm certbot renew --dry-run succeeds right after initial setup
• Ensure firewalld allows both HTTP (for renewal challenges) and HTTPS permanently, not just during initial setup
• Follow the same renewal monitoring practices covered in How to Renew and Auto-Renew Let's Encrypt Certificates

Related Articles

• How to Install Nginx on AlmaLinux/Rocky Linux
• How to Configure firewalld on AlmaLinux/Rocky Linux
• How to Renew and Auto-Renew Let's Encrypt Certificates