Let's Encrypt Free SSL Certificate Tutorial: Certbot Automated Setup

Let's Encrypt Free SSL Certificate Tutorial: Certbot Automated Setup

Let's Encrypt is a free, automated, and open certificate authority (CA). Over 400 million websites use its certificates. Although certificates are valid for only 90 days, Certbot enables fully automatic renewal.

1. Prerequisites

• Server with root/sudo access
• Domain pointed to server IP
• Web server (Nginx or Apache)
• Ports 80 and 443 open
• Ubuntu/Debian/RHEL/CentOS

1.1 Install Certbot

# Ubuntu/Debian
apt update
apt install certbot python3-certbot-nginx

# RHEL/CentOS 8+
dnf install certbot python3-certbot-nginx

2. Request Certificate

2.1 Auto Mode (Recommended)

# Nginx
certbot --nginx -d example.com -d www.example.com

# Apache
certbot --apache -d example.com -d www.example.com

Certbot automatically: verifies domain ownership, installs the certificate, configures the web server, sets up auto-renewal.

2.2 Manual Mode

certbot certonly --nginx -d example.com -d www.example.com

2.3 DNS Validation (Wildcard)

certbot certonly --manual --preferred-challenges dns -d *.example.com

3. Certificate Files

Certificates are stored at /etc/letsencrypt/live/example.com/:

4. Web Server Configuration

4.1 Nginx SSL

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

5. Auto-Renewal

# Test renewal
certbot renew --dry-run

# Manual renewal
certbot renew

Certbot checks twice daily and auto-renews certificates within 30 days of expiry.

6. Alternative Free SSL

7. Common Issues

• Renewal failure: Check port 80 access, DNS, disk space
• Untrusted certificate: Use fullchain.pem instead of cert.pem

8. Summary

Let's Encrypt + Certbot is the best free SSL solution. With auto-renewal, you get permanent HTTPS for free. All websites should enable HTTPS for security, SEO, and user trust.