F3 cloud · Knowledge base

English

Русский

English

Русский

Appearance

Installing a free Let's Encrypt SSL certificate on a server with Nginx or Apache

An overview of free SSL certificates. In this article, we will cover: how SSL certificates work; the pros of an SSL certificate; What types of SSL certificates there are; How to get a free SSL certificate for free

Installing a free Let's Encrypt SSL certificate on a server with Nginx or Apache ​

What Let's Encrypt is and why you need an SSL certificate

Let's Encrypt – an open certificate authority that provides free SSL certificates, which allow you to encrypt the connection between a website and a user. An SSL certificate:

  • Provides an HTTPS connection
  • Protects data from interception
  • Increases user trust
  • Improves SEO rankings in search engines

Installing an SSL certificate is a mandatory step for any modern website, whether it is a personal blog, an online shop or a corporate portal.

Preparing the server for SSL certificate installation ​

Before starting the installation, you need to update the system and repositories:

bash
sudo apt-get -y update && sudo apt-get -y dist-upgrade

This command will update the list of available packages and perform a full upgrade of the installed components. It is recommended to run it on an up-to-date version of Ubuntu or Debian.

Installing Certbot – a tool for working with Let's Encrypt ​

Certbot – the official Let's Encrypt client. To install it, run:

bash
sudo apt-get -y install certbot

Once the installation is complete, you will be able to use Certbot to generate, renew and manage SSL certificates.

Installing additional Certbot modules for Nginx and Apache ​

To integrate Certbot with a specific web server, you need to install the corresponding plugin.

For Nginx:

bash
sudo apt-get -y install python3-certbot-nginx

For Apache2:

bash
sudo apt-get -y install python3-certbot-apache

After installing the plugins, you can move on to generating certificates.

Requirements for successful SSL certificate generation ​

Before running Certbot, make sure that:

  • The web server (Nginx or Apache) is running
  • The specified domain points to the server's IP address
  • Port 80 (HTTP) is open

This is critically important, as Certbot uses an HTTP challenge to validate the domain.

Generating an SSL certificate with Certbot for Nginx ​

If you are using Nginx, run the following command:

bash
sudo certbot certonly --nginx -d yoursite.com

Replace yoursite.com with your actual domain. Once the process is complete, the certificate will be saved to /etc/letsencrypt/live/yoursite.com/.

Generating an SSL certificate with Certbot for Apache ​

A different command is used for Apache:

bash
sudo certbot certonly --apache -d yoursite.com

Certbot will automatically detect the Apache configurations and offer to add SSL to the configuration files automatically.

Alternative: Generating with standalone (without a web server) ​

If the web server cannot be started (for example, port 80 is busy or the site is temporarily down), you can use standalone mode:

bash
sudo certbot certonly --standalone -d yoursite.com

In this case, Certbot spins up its own temporary HTTP server to pass validation.

Setting up automatic SSL certificate renewal ​

Let's Encrypt certificates are valid for 90 days. To renew a certificate manually, use:

bash
sudo certbot renew

To set up automatic renewal, add a task to cron or use a system timer:

bash
sudo systemctl list-timers | grep certbot

Certbot automatically checks certificates twice a day and renews them when necessary.

Checking certificate validity and expiry dates ​

To check the certificate status, use:

bash
sudo certbot certificates

The command will display all current certificates, the expiry date and the path to the keys.

Common errors and how to fix them ​

ErrorCauseSolution
Timeout during generationPort 80 is closedOpen the port in the firewall
"Domain not found"DNS is not configuredCheck the domain's A record
"Permission denied"Insufficient permissionsRun with sudo
Certificate not appliedAuto-configuration did not workAdd SSL manually to the web server config

Conclusion: Fast and reliable encryption with Let's Encrypt ​

Let's Encrypt provides a convenient and free way to secure your website. With Certbot, the process of installing and renewing certificates is fully automated, especially when using Nginx or Apache. By following these instructions, you will be able to get a valid certificate and activate HTTPS on your domain in a few minutes.

Frequently asked questions (FAQ) ​

Can Let's Encrypt be used for subdomains?

Yes. Just specify the subdomain: -d sub.yoursite.com.

Does Let's Encrypt work with IPv6?

Yes. The main thing is that the DNS records are correct.

Can a certificate be installed on a local IP?

No. Only on public domains accessible over HTTP.

What should you do if the certificate has expired?

Run sudo certbot renew and restart the web server.

Can the certificate be used with other web servers (for example, Caddy)?

Yes. The certificate can be exported from /etc/letsencrypt/ and used manually.

Does Let's Encrypt work with wildcard certificates?

Yes, when using a DNS challenge.

Useful resources ​

Our resources ​

Telegram channel: https://t.me/
F3 Cloud: https://f3cloud.com

F3 Cloud Knowledge Base

© 2026 F3 Cloud