Let's Encrypt with Certbot in Nginx - Commands & Configuration

Introduction

Websites need secure connections to protect user data. Let's Encrypt provides free SSL certificates to enable HTTPS. Certbot is a tool that helps get and install these certificates automatically for your web server.

When you want to secure your website with HTTPS without paying for certificates.

When you need to automatically renew SSL certificates to avoid expiration.

When you run an Nginx web server and want an easy way to enable HTTPS.

When you want to improve your website's trust and SEO ranking by using HTTPS.

When you want to protect user login and data transmission on your site.

Config File - nginx.conf

nginx.conf

server {
    listen 80;
    server_name example.com www.example.com;

    location /.well-known/acme-challenge/ {
        root /var/www/certbot;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    location / {
        root /var/www/html;
        index index.html index.htm;
    }
}

This Nginx configuration has two server blocks:

• The first listens on port 80 (HTTP) and serves the challenge files needed by Certbot to verify domain ownership. It also redirects all other HTTP traffic to HTTPS.
• The second listens on port 443 (HTTPS) and uses the SSL certificates obtained by Certbot to serve the website securely.

Commands

Update the package list to get the latest versions available.

Terminal

sudo apt update

Expected Output

Hit:1 http://archive.ubuntu.com/ubuntu focal InRelease

Reading package lists... Done

Install Certbot and the Nginx plugin to obtain and configure SSL certificates.

Terminal

sudo apt install certbot python3-certbot-nginx -y

Expected Output

Reading package lists... Done

Building dependency tree       

Reading state information... Done

The following additional packages will be installed:

  ...

Setting up certbot (1.22.0-1) ...

Setting up python3-certbot-nginx (1.22.0-1) ...

→

-y - Automatically answer yes to prompts

Run Certbot to get SSL certificates for example.com and www.example.com and automatically update Nginx configuration.

Terminal

sudo certbot --nginx -d example.com -d www.example.com

Expected Output

Saving debug log to /var/log/letsencrypt/letsencrypt.log

Plugins selected: Authenticator nginx, Installer nginx

Obtaining a new certificate

Performing the following challenges:

http-01 challenge for example.com

http-01 challenge for www.example.com

Waiting for verification...

Cleaning up challenges



IMPORTANT NOTES:

 - Congratulations! Your certificate and chain have been saved at:

   /etc/letsencrypt/live/example.com/fullchain.pem

 - Your cert will expire on 2024-09-01. To obtain a new or tweaked

   version of this certificate in the future, simply run certbot again

 - Your nginx configuration was updated to use the new certificate.

→

--nginx - Use the Nginx plugin to automatically configure SSL

→

-d - Specify domain names for the certificate

Reload Nginx to apply the new SSL configuration without downtime.

Terminal

sudo systemctl reload nginx

Expected Output

No output (command runs silently)

Test automatic renewal of certificates to ensure it will work when needed.

Terminal

sudo certbot renew --dry-run

Expected Output

Saving debug log to /var/log/letsencrypt/letsencrypt.log



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Processing /etc/letsencrypt/renewal/example.com.conf

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Cert not yet due for renewal



- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Congratulations, all renewals succeeded.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

→

--dry-run - Simulate renewal without making changes

Key Concept

If you remember nothing else from this pattern, remember: Certbot automates getting and installing free SSL certificates to secure your Nginx website with HTTPS.

Common Mistakes

Not opening port 80 in the firewall before running Certbot

Certbot needs to verify domain ownership via HTTP on port 80; blocking it causes verification failure.

Ensure port 80 is open in your firewall before running Certbot.

Running Certbot without the --nginx flag when using Nginx

Without the Nginx plugin, Certbot won't automatically update your Nginx config to use the new certificates.

Use 'certbot --nginx' to let Certbot configure Nginx automatically.

Not reloading Nginx after certificate installation

Nginx won't use the new certificates until it reloads the configuration.

Run 'sudo systemctl reload nginx' after Certbot finishes.

Summary

Install Certbot and the Nginx plugin to manage SSL certificates.

Run Certbot with the --nginx flag and your domain names to get and install certificates.

Reload Nginx to apply the new SSL configuration.

Test automatic renewal with 'certbot renew --dry-run' to avoid certificate expiration.

Practice

1. What is the main purpose of using Certbot with nginx when working with Let's Encrypt?

easy

A. To create backups of nginx configuration files

B. To configure nginx to serve static files faster

C. To monitor server performance and uptime

D. To automatically obtain and install SSL certificates for secure HTTPS connections

Solution

1. Step 1: Understand Certbot's role

   Certbot is a tool designed to automate the process of obtaining SSL certificates from Let's Encrypt.

2. Step 2: Connect Certbot with nginx

   Certbot can automatically configure nginx to use these certificates, enabling HTTPS.

3. Final Answer:

   To automatically obtain and install SSL certificates for secure HTTPS connections -> Option D

4. Quick Check:

   Certbot = SSL automation [OK]

Hint: Certbot automates SSL setup for nginx [OK]

Common Mistakes:

• Thinking Certbot monitors server performance
• Confusing Certbot with backup tools
• Believing Certbot speeds up static file delivery

2. Which of the following is the correct command to obtain and install a certificate for nginx using Certbot?

easy

A. certbot renew --nginx

B. certbot --nginx -d example.com

C. certbot --apache -d example.com

D. certbot install --nginx example.com

Solution

1. Step 1: Identify the command to obtain and install

   The command to get and install a certificate for nginx is 'certbot --nginx -d domain'.

2. Step 2: Check options correctness

   certbot --nginx -d example.com uses '--nginx' and '-d example.com' correctly. certbot --apache -d example.com is for Apache, A is for renewal, D is invalid syntax.

3. Final Answer:

   certbot --nginx -d example.com -> Option B

4. Quick Check:

   Certbot obtain + nginx = certbot --nginx -d [OK]

Hint: Use '--nginx' flag with '-d' domain to get cert [OK]

Common Mistakes:

• Using '--apache' flag for nginx
• Confusing 'renew' with 'obtain' commands
• Using invalid 'install' subcommand

3. After running certbot --nginx -d example.com successfully, what will be the expected change in the nginx configuration?

medium

A. nginx config will include SSL directives and listen on port 443

B. nginx will stop serving HTTP requests

C. nginx config will remove all server blocks

D. nginx will only serve HTTP on port 80

Solution

1. Step 1: Understand Certbot's nginx plugin effect

   Certbot modifies nginx config to add SSL settings and enable HTTPS on port 443.

2. Step 2: Analyze expected config changes

   It does not remove server blocks or disable HTTP; it adds SSL directives alongside HTTP.

3. Final Answer:

   nginx config will include SSL directives and listen on port 443 -> Option A

4. Quick Check:

   Certbot adds SSL and port 443 config [OK]

Hint: Certbot adds SSL and port 443 to nginx config [OK]

Common Mistakes:

• Thinking HTTP is disabled after certbot run
• Believing server blocks are deleted
• Assuming nginx only listens on port 80

4. You ran certbot --nginx -d example.com but got an error: Failed authorization procedure. What is the most likely cause?

medium

A. Certbot version is too new

B. nginx is not installed on the server

C. Port 80 is blocked or not accessible from the internet

D. The domain name is misspelled in the command

Solution

1. Step 1: Understand the error meaning

   'Failed authorization procedure' means Let's Encrypt could not verify domain ownership.

2. Step 2: Identify common cause

   Let's Encrypt uses HTTP challenge on port 80; if blocked, verification fails.

3. Final Answer:

   Port 80 is blocked or not accessible from the internet -> Option C

4. Quick Check:

   Port 80 open = authorization success [OK]

Hint: Check port 80 accessibility for HTTP challenge [OK]

Common Mistakes:

• Assuming nginx absence causes authorization error
• Ignoring domain spelling mistakes
• Blaming Certbot version without checking network

5. You want to automate renewal of your Let's Encrypt certificates on nginx using Certbot. Which approach is best?

hard

A. Set up a cron job to run certbot renew --quiet regularly

B. Manually run certbot --nginx -d example.com every month

C. Restart nginx daily to trigger automatic renewal

D. Delete old certificates and request new ones weekly

Solution

1. Step 1: Understand Certbot renewal process

   Certbot can renew certificates automatically using the 'renew' command.

2. Step 2: Automate renewal with cron

   Setting a cron job to run 'certbot renew --quiet' regularly ensures certificates renew before expiry without manual work.

3. Final Answer:

   Set up a cron job to run certbot renew --quiet regularly -> Option A

4. Quick Check:

   Automate renewal with cron + certbot renew [OK]

Hint: Use cron with 'certbot renew --quiet' for auto-renewal [OK]

Common Mistakes:

• Manually renewing certificates often
• Restarting nginx does not renew certs
• Deleting certs causes downtime and errors