Security & Firewalls Beginner 10 min

How to Install Free Let's Encrypt SSL with Certbot on Nginx

Automate HTTPS encryption, TLS 1.3 protocol configuration, and automated 90-day certificate renewals

IndSoft Cloud Engineering
Reviewed October 2026
Production Verified Commands

Guide Overview & Architecture Outcome

By following this guide, your domain will be secured with a free, trusted Let's Encrypt SSL/TLS certificate. Certbot will configure Nginx automatically to redirect HTTP to HTTPS and set up automatic renewal cron jobs.

Table of Contents
Step 1: Install Certbot and Nginx Python Plu... Step 2: Obtain and Install SSL Certificate... Step 3: Verify Automated Renewal Daemon... Check That It Worked Troubleshooting
Practice on Live Cloud

Spin up an Ubuntu 24.04 instance with instant activation to test this tutorial:

Deploy IndSoft VPS

Prerequisites & System Requirements

An Ubuntu server running Nginx with your domain DNS record pointing to your server's public IP address.

1

Install Certbot and Nginx Python Plugin

Install Certbot using the snap package manager or official apt repository.

bash · step-1-command.sh
sudo apt install certbot python3-certbot-nginx -y
Expected System Output:
Setting up certbot (2.9.0-1) ... Setting up python3-certbot-nginx ...
2

Obtain and Install SSL Certificate

Run Certbot with the --nginx flag to automatically detect virtual hosts and install certificates.

bash · step-2-command.sh
sudo certbot --nginx -d example.com -d www.example.com
Expected System Output:
Requesting a certificate for example.com and www.example.com Successfully received certificate. Deploying certificate Successfully deployed certificate for example.com to /etc/nginx/sites-enabled/example.com Congratulations! You have successfully enabled HTTPS.
3

Verify Automated Renewal Daemon

Certbot installs a systemd timer that tests renewal twice daily. Run a dry run to verify renewability.

bash · step-3-command.sh
sudo certbot renew --dry-run
Expected System Output:
Simulating renewal of an existing certificate for example.com Congratulations, all simulated renewals succeeded.

Check That It Worked (Verification)

Run this quick verification check to confirm your installation is responding properly:

verify-service.sh
curl -Iv https://example.com 2>&1 | grep 'SSL certificate verify ok'
Expected Response:
* SSL certificate verify ok. * Server certificate: * subject: CN=example.com * issuer: C=US; O=Let's Encrypt; CN=R3

Troubleshooting Common Errors

Quick resolutions for frequent setup pitfalls and configuration issues.

Diagnostic Tips
Certbot fails with 'Problem binding to port 80'
Another service is blocking port 80. Ensure Apache is not running alongside Nginx: sudo systemctl stop apache2.
DNS validation timeout
Ensure your domain's A record has propagated across public DNS servers before running Certbot. Check with dig +short example.com.
Nginx syntax error after certificate installation
Run sudo nginx -t to inspect line numbers in your configuration file. Check for duplicate ssl_certificate directives.