Install a free SSL certificate with Certbot (Nginx or Apache, Ubuntu)

Install Certbot, run sudo certbot --nginx or sudo certbot --apache, and you get a free Let's Encrypt certificate that renews itself.

Before you start

• Your domain's A record (and the www record) points to the server's IP address. Check with dig +short example.com on your computer: it should print your server's IP.
• The website already works over plain http://. Let's Encrypt checks your domain on port 80.
• Ports 80 and 443 are open in the firewall: sudo ufw allow 'Nginx Full' or sudo ufw allow 'Apache Full'.
• Nginx: the site's server block contains server_name example.com www.example.com;. Apache: the virtual host has ServerName and ServerAlias. Certbot uses them to find the right site (see Install a LEMP stack and Host several websites on one server with Apache).

Install Certbot

The Certbot team recommends the snap package, which always has the newest version. Remove a Certbot installed with apt first, so the two don't get in each other's way:

sudo apt remove certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot

The last line makes the certbot command available everywhere. Check it with certbot --version.

Prefer Ubuntu's own packages? sudo apt install certbot python3-certbot-nginx (or python3-certbot-apache) works too and is updated with the system. Use one way, not both.

Get the certificate

For Nginx:

sudo certbot --nginx -d example.com -d www.example.com

For Apache:

sudo certbot --apache -d example.com -d www.example.com

The first time, Certbot asks for an email address (for expiry warnings) and for you to accept the Let's Encrypt terms. It then checks the domain, gets the certificate and adds the HTTPS settings to your Nginx or Apache configuration. To also send every http:// visitor to HTTPS, add --redirect to the command.

Open https://example.com in your browser: you should see the lock icon. List your certificates and their expiry dates with:

sudo certbot certificates

If you'd rather edit the web server configuration yourself, get the certificate only with sudo certbot certonly --nginx (or --apache). The files are then in /etc/letsencrypt/live/example.com/: fullchain.pem and privkey.pem.

Automatic renewal

Let's Encrypt certificates are only valid for a few months, so they must be renewed regularly. Certbot installs a timer that does it for you. Test that the renewal works:

sudo certbot renew --dry-run

It should report that all simulated renewals succeeded. systemctl list-timers shows the certbot timer and when it runs next.

Add a domain or remove a certificate

To add a domain later, run the certbot --nginx or certbot --apache command again with all the domains the certificate should cover. To delete a certificate you no longer need:

sudo certbot delete --cert-name example.com

Remove the HTTPS lines that point to it from your web server configuration first, or the web server won't start.

Common problems

Timeout during connect or unauthorized

Let's Encrypt couldn't reach your site on port 80. Check that the domain points to this server (dig +short example.com), that port 80 is open (sudo ufw status), and that http://example.com loads in a browser. A new or changed DNS record can take a while to reach everyone.

Could not automatically find a matching server block

Nginx has no server_name line with this domain. Add it to the site's server block, run sudo nginx -t and sudo systemctl reload nginx, then run Certbot again.

Too many certificates already issued

Let's Encrypt limits how many certificates you can get for the same domains in a week. Wait, and use --dry-run while you test, which doesn't count.

The browser still warns after installing

Clear the browser cache or try a private window. If the warning names another domain, the certificate doesn't cover the address you opened, for example www: run Certbot again with both names.

Related articles

• Install a LEMP stack (Nginx, MySQL, PHP) on Ubuntu
• Host several websites on one server with Apache
• Set up a firewall with UFW on Ubuntu
• Secure a new Linux server: first 10 steps

Still stuck? Open a support ticket and we'll help.