SSL Certificate Installation: Let’s Encrypt

01What Are Let's Encrypt and Certbot?

Let's Encrypt is a certificate authority run by the non-profit ISRG that issues domain-validated (DV) certificates for free. If you are curious about what a certificate does and what types exist, start with our what is an SSL certificate article.

Certbot is the official client developed by the EFF that talks to Let's Encrypt over the ACME protocol. It requests the certificate, verifies that the domain belongs to you, configures Nginx or Apache and schedules renewal.

Let's Encrypt certificates are short-lived; the default validity is 90 days, and the organization has announced that it will shorten this period gradually. So always rely on automatic renewal instead of renewing by hand.

02Pre-Installation Checklist

The most common point of failure for Certbot is domain validation. If the items below are all in place, installation usually finishes in a few minutes.

• The domain's A and AAAA records point to the correct server IP (if an AAAA record exists, the site must respond over IPv6 as well)
• Ports 80 and 443 are open in the server firewall
• Nginx or Apache is running and a server block or virtual host is defined for the domain
• You can connect to the server over SSH with a user that has sudo privileges
• If you use a proxy such as Cloudflare, you know its proxy setting for the first installation

dig +short ornek.com A
dig +short www.ornek.com A
sudo ufw status
# If you use Nginx
sudo ufw allow 'Nginx Full'

03Installing Certbot Step by Step

Certbot's official site, certbot.eff.org, recommends the snap package for Ubuntu and Debian, so Certbot stays up to date regardless of the distribution. If you prefer not to use snap, the distribution's own apt packages work too.

With snap (recommended)

If a certbot package was previously installed with apt, remove it first to avoid conflicts.

sudo apt remove certbot
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
certbot --version

With the apt package

With this method you also need to install the plugin package that matches your web server.

sudo apt update
# For Nginx
sudo apt install certbot python3-certbot-nginx
# For Apache
sudo apt install certbot python3-certbot-apache

04Getting and Installing the Certificate

Thanks to its plugin, Certbot reads your existing configuration and, based on the server_name or ServerName values, asks which domains to issue a certificate for. It is best to include both the bare domain and the www version in the same certificate.

During the command you are asked for an email address and to accept the terms of service. Certbot publishes a temporary file at the .well-known/acme-challenge path for validation, and Let's Encrypt reads this file over port 80 to confirm the domain belongs to you.

• Certificate files are kept under /etc/letsencrypt/live/example.com/.
• fullchain.pem contains the server certificate together with the intermediate certificate; use this one in the web server.
• privkey.pem is the private key; do not copy it anywhere or share it with anyone.

sudo certbot --nginx -d ornek.com -d www.ornek.com

sudo certbot --apache -d ornek.com -d www.ornek.com

sudo certbot certonly --webroot -w /var/www/ornek.com/html \
  -d ornek.com -d www.ornek.com

05How to Set Up Auto-Renewal

Snap and apt packages add a systemd timer or cron job during installation. This job runs several times a day and renews certificates that are close to expiring. The only thing left for you to do is to test that renewal really works.

Because Let's Encrypt has stopped sending expiry warning emails, it is a good habit to track the certificate expiry date with your own monitoring tool. You can also define a renewal hook (deploy hook) so the web server picks up the new certificate after renewal.

sudo certbot renew --dry-run
sudo certbot certificates
systemctl list-timers | grep -i certbot

# Hook that reloads Nginx after every successful renewal
echo '#!/bin/sh
systemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

06HTTPS Redirects and Mixed Content

Certbot's Nginx and Apache plugins usually add the rule that redirects HTTP requests to HTTPS for you. If you want to do it by hand, use a permanent 301 redirect; that way search engines carry the value of the old URLs over to the new ones.

On shared hosting that runs Apache, you do the same job with the .htaccess file; detailed rules are in our htaccess redirect guide. If, after the redirect, the page still loads an image, script or font over http://, the browser shows a mixed content warning; replace these URLs with https or relative paths.

server {
    listen 80;
    listen [::]:80;
    server_name ornek.com www.ornek.com;
    return 301 https://ornek.com$request_uri;
}

07HSTS and Secure TLS Settings

Once the redirect works, you can use the HSTS header to tell browsers to open your site only over HTTPS from now on. After the first visit, this header prevents anyone from stepping in and downgrading the connection to HTTP.

Don't enable HSTS for a long period in a hurry. If one of your subdomains still doesn't support HTTPS, access to that address will be cut off. Try a short max-age value first and extend it once everything runs smoothly; add the includeSubDomains and preload options only when you are sure all subdomains are ready.

Certbot's Nginx and Apache plugins add a configuration file with up-to-date, secure TLS protocol settings. Keep the old TLS 1.0 and 1.1 versions disabled; checking your server configuration periodically with public test tools such as SSL Labs helps you spot an overlooked weak setting early.

# Inside the 443 server block
add_header Strict-Transport-Security "max-age=300" always;

08Verification and Common Errors

Don't settle for the lock icon in the browser; verify the installation from the command line too. The commands below show who issued the certificate, its expiry date and the redirect chain.

curl -I http://ornek.com
curl -I https://www.ornek.com
openssl s_client -connect ornek.com:443 -servername ornek.com </dev/null 2>/dev/null \
  | openssl x509 -noout -issuer -dates

09Wildcard Certificates, Windows and Control Panels

A wildcard certificate in the form *.example.com can only be obtained with DNS validation. If Certbot has a plugin for your DNS provider, renewal is automatic; certificates obtained with the --manual method require you to add a TXT record by hand every time.

If you use Windows Server and IIS, you can achieve the same result with Windows clients that support the ACME protocol. Hosting control panels mostly offer Let's Encrypt support as a one-click option; in that case you don't need to type any commands on the server.

HTTPS is only one part of speed and security work. Handled together with HTTP/2, cache headers and compression, you gain both trust and performance; in our SEO-friendly web design projects we plan these layers from the start.

sudo certbot certonly --manual --preferred-challenges dns \
  -d ornek.com -d "*.ornek.com"