Teadmistebaas

Let's Encrypt provides free, automated SSL/TLS certificates trusted by all major browsers. Certbot is the official client that requests, installs, and configures HTTPS for you automatically — for both Nginx and Apache.

Prerequisites

• Ubuntu or Debian VPS
• Nginx or Apache already installed and running
• A domain name with its A record already pointing to your VPS's IP
• Ports 80 and 443 open in the firewall

Step 1 — Install Certbot

For Nginx:

sudo apt update
sudo apt install certbot python3-certbot-nginx -y

For Apache:

sudo apt install certbot python3-certbot-apache -y

Step 2 — Confirm DNS Is Pointing to This Server

dig +short yourdomain.com

The result must match your VPS's public IP before requesting a certificate.

Step 3 — Request and Install the Certificate

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot will ask for an email (for renewal notices) and whether to redirect HTTP to HTTPS automatically — choose yes.

Step 4 — Verify HTTPS Is Working

https://yourdomain.com

Your browser should show a valid padlock icon.

Step 5 — List Installed Certificates

sudo certbot certificates

Step 6 — Test Automatic Renewal

sudo certbot renew --dry-run

Let's Encrypt certificates are valid for 90 days; Certbot installs a systemd timer or cron job that renews automatically before expiry — see How to Renew and Auto-Renew Let's Encrypt Certificates for details.

Common Errors

"Challenge failed" — DNS isn't pointing to this server yet, or port 80 is blocked by the firewall:

sudo ufw status

"Could not bind to port 80" — another process is already using it:

sudo ss -tulpn | grep :80

Certificate installed but site still shows HTTP — confirm the redirect was enabled, or re-run Certbot and choose the redirect option.

Best Practices

• Always redirect HTTP to HTTPS for production sites
• Never rely on manual renewal — verify the automatic renewal timer is active
• Include multiple subdomains (-d www.yourdomain.com) in the same certificate request when needed

FAQ

Is Let's Encrypt really free forever?
Yes — there's no cost or licensing fee; certificates just need to be renewed every 90 days, which Certbot automates.

Can I secure multiple domains with one certificate?
Yes, by adding multiple -d flags in the same Certbot command (a SAN certificate).

Related Articles

• How to Renew and Auto-Renew Let's Encrypt Certificates
• How to Install a Wildcard SSL Certificate with Certbot DNS Challenge
• HTTP to HTTPS Redirect + Forcing SSL (Nginx & Apache)