Let's Encrypt Free SSL Certificate Tutorial: Certbot Automated Setup

Let's Encrypt Free SSL Certificate Tutorial: Certbot Automated Setup

Let's Encrypt is a free, automated, and open certificate authority (CA). Over 400 million websites use its certificates. The 90-day validity looks like a drawback, but it is a deliberate design: a short lifetime forces automation. Combined with the ACME protocol and Certbot, certificates can be issued, installed, and renewed fully automatically — truly "configure once, never expire". For budget-conscious individuals and small businesses, this is the step that turns HTTPS from an expense into a default.

1. Prerequisites

• Server with root/sudo access
• Domain pointed to server IP
• Web server (Nginx or Apache)
• Ports 80 and 443 open
• Ubuntu/Debian/RHEL/CentOS

1.1 Install Certbot

# Ubuntu/Debian
apt update
apt install certbot python3-certbot-nginx

# RHEL/CentOS 8+
dnf install certbot python3-certbot-nginx

1.2 Three Ways to Verify Domain Ownership

Before issuing a certificate, Let's Encrypt must prove you control the domain. The three common challenges are:

Certbot's --nginx / --apache auto mode defaults to HTTP-01; to issue *.example.com wildcards, you must use DNS-01.

2. Request Certificate

2.1 Auto Mode (Recommended)

# Nginx
certbot --nginx -d example.com -d www.example.com

# Apache
certbot --apache -d example.com -d www.example.com

Certbot automatically: verifies domain ownership, installs the certificate, configures the web server, sets up auto-renewal.

2.2 Manual Mode

certbot certonly --nginx -d example.com -d www.example.com

2.3 DNS Validation (Wildcard)

certbot certonly --manual --preferred-challenges dns -d *.example.com

3. Certificate Files

Certificates are stored at /etc/letsencrypt/live/example.com/:

4. Web Server Configuration

4.1 Nginx SSL

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

5. Auto-Renewal

# Test renewal (does not actually renew)
certbot renew --dry-run

# Manual renewal
certbot renew

Certbot checks twice daily and auto-renews certificates within 30 days of expiry.

5.1 Verify After Setup

Getting the certificate is only the first step; confirm the configuration actually works:

# List all certificates and their expiry dates
certbot certificates

# See the subject/issuer returned during the handshake
curl -vI https://example.com 2>&1 | grep -i "subject:\|issuer:"

# Read the certificate validity directly
echo | openssl s_client -servername example.com -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

You can also submit the domain to SSL Labs (https://www.ssllabs.com/ssltest/) for a grade; anything below A usually means there is room to tune the configuration.

6. Alternative Free SSL

7. Common Issues

• Renewal failure: Check port 80 access, DNS, disk space
• Untrusted certificate: Use fullchain.pem instead of cert.pem

8. Summary

Let's Encrypt + Certbot is the most maintenance-free free HTTPS solution for self-managed servers: configure auto-renewal once and you rarely touch the certificates again. Every website should enable HTTPS for security, SEO, and user trust — and pairing it with HSTS plus security header configuration brings transport security to a high standard.

Reference: Let's Encrypt documentation https://letsencrypt.org/docs/; Certbot documentation https://certbot.eff.org/docs/