Skip to main content
To get a free SSL certificate with Certbot, point your domain’s DNS at the server, install Certbot with its Nginx or Apache plugin, then run sudo certbot --nginx -d example.com -d www.example.com (or --apache). Certbot gets a Let’s Encrypt certificate, adds HTTPS to your site config and sets up automatic renewal. Check renewal with sudo certbot renew --dry-run.

​
Before you start

  • DNS must point to the server. Create an A record (and AAAA for IPv6) for example.com and www.example.com with your server’s IP. See point a domain to your server. Check with dig +short example.com.
  • Port 80 must be reachable from the internet. Let’s Encrypt connects to it to confirm you control the domain. Allow 443 too, for HTTPS.
  • A working site config with server_name example.com www.example.com; (Nginx) or ServerName example.com (Apache). See Nginx server blocks or install Apache.
  • Use a user with sudo. If you are root, leave out sudo.
SSL/TLS encrypts traffic between visitors and your site and turns http:// into https://. Let’s Encrypt is a free certificate authority; Certbot is the tool that requests and renews its certificates.

​
How to install Certbot

For Apache, install python3-certbot-apache instead of python3-certbot-nginx.

​
How to get the certificate

1

Run Certbot with your web server plugin

For Apache:
2

Answer the prompts

Enter an email address (for expiry and security notices, for example you@example.com) and accept the terms. Certbot then proves you control the domain, saves the certificate and edits your site config to use it.
3

Open your site over HTTPS

Visit https://example.com. Certbot also adds a redirect from HTTP to HTTPS by default (use --no-redirect to skip it).
Prefer to edit the config yourself? Use sudo certbot certonly --nginx -d example.com to only get the certificate. The files are then in /etc/letsencrypt/live/example.com/:

​
How to check that renewal works

Let’s Encrypt certificates currently last 90 days, and Let’s Encrypt plans to cut this to 45 days by February 2028, so renewal must be automatic. Certbot installs a timer that checks twice a day and renews certificates that are close to expiry. Run a test renewal against the staging server:
It should end with Congratulations, all simulated renewals succeeded. See the timer:
The apt and EPEL packages use certbot.timer; the snap uses snap.certbot.renew.timer. List your certificates and expiry dates with:

​
Frequently asked questions

​
Certbot says “Timeout during connect” or “Connection refused”. Why?

Let’s Encrypt could not reach port 80 on your server. Check that the DNS record points to this server, the web server is running and your firewall allows port 80. See check if a port is open from outside.

​
Can I get a wildcard certificate (*.example.com)?

Yes, but only with the DNS challenge, which needs a TXT record per renewal. Use a Certbot DNS plugin for your DNS provider so renewals stay automatic.

​
Do I need to restart Nginx after renewal?

No. The --nginx and --apache plugins reload the web server after renewing. With certonly, add --deploy-hook "systemctl reload nginx" so the new certificate is loaded.

​
I use Caddy. Do I need Certbot?

No. Caddy gets and renews certificates by itself. See install Caddy.

VPS and dedicated server guides

Every server guide in one place.

Point a domain to your server

Set the A record first.

Nginx server blocks

One config per domain.

Nginx reverse proxy

HTTPS in front of your app.

Website not loading

Fix common errors.
Checked against the official Certbot instructions and Let’s Encrypt certificate lifetime plans on 4 November 2026; Certbot 2.9.0 package names, plugin options and the certbot.timer unit checked on Ubuntu 24.04 LTS. Certificates were not issued in the test (no public domain). Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026