> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Get a Free SSL Certificate with Certbot (Nginx and Apache)

> Get a free Let's Encrypt SSL certificate for Nginx or Apache: install Certbot, run sudo certbot --nginx -d example.com, then test auto-renewal with --dry-run.

To get a free SSL certificate with Certbot, point your domain's DNS at the server, install Certbot with its Nginx or Apache plugin, then run `sudo certbot --nginx -d example.com -d www.example.com` (or `--apache`). Certbot gets a Let's Encrypt certificate, adds HTTPS to your site config and sets up automatic renewal. Check renewal with `sudo certbot renew --dry-run`.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner | 10 minutes | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux / Rocky 9 / 10 | A domain, Nginx or Apache, port 80 open |

## Before you start

* **DNS must point to the server.** Create an `A` record (and `AAAA` for IPv6) for `example.com` and `www.example.com` with your server's IP. See [point a domain to your server](https://help.freakhosting.com/portals/other/how-to-point-a-domain-to-your-server.md). Check with `dig +short example.com`.
* **Port 80 must be reachable from the internet.** Let's Encrypt connects to it to confirm you control the domain. Allow 443 too, for HTTPS.
* **A working site config** with `server_name example.com www.example.com;` (Nginx) or `ServerName example.com` (Apache). See [Nginx server blocks](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-server-blocks.md) or [install Apache](https://help.freakhosting.com/portals/other/how-to-install-apache.md).
* Use a user with `sudo`. If you are `root`, leave out `sudo`.

SSL/TLS encrypts traffic between visitors and your site and turns `http://` into `https://`. Let's Encrypt is a free certificate authority; Certbot is the tool that requests and renews its certificates.

## How to install Certbot

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt update
> sudo apt install certbot python3-certbot-nginx
> ```
>
> For Apache, install `python3-certbot-apache` instead of `python3-certbot-nginx`.

> [tab] AlmaLinux / Rocky
>
> Certbot comes from the EPEL repository:
>
> ```bash theme={null}
> sudo dnf install epel-release
> sudo dnf install certbot python3-certbot-nginx
> ```
>
> For Apache, install `python3-certbot-apache` instead.

> [tab] Snap (Certbot's own method)
>
> The Certbot project recommends its snap package, which always has the latest version. Remove any distribution package first, then:
>
> ```bash theme={null}
> sudo snap install --classic certbot
> sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
> ```
>
> `snapd` must be installed; it is present on Ubuntu by default.

## How to get the certificate

**1. Run Certbot with your web server plugin**

```bash theme={null}
sudo certbot --nginx -d example.com -d www.example.com
```

For Apache:

```bash theme={null}
sudo certbot --apache -d example.com -d www.example.com
```

**2. Answer the prompts**

Enter an email address (for expiry and security notices, for example `you@example.com`) and accept the terms. Certbot then proves you control the domain, saves the certificate and edits your site config to use it.

**3. Open your site over HTTPS**

Visit `https://example.com`. Certbot also adds a redirect from HTTP to HTTPS by default (use `--no-redirect` to skip it).

Prefer to edit the config yourself? Use `sudo certbot certonly --nginx -d example.com` to only get the certificate. The files are then in `/etc/letsencrypt/live/example.com/`:

| File | Use |
| - | - |
| `fullchain.pem` | Certificate plus chain (`ssl_certificate` in Nginx, `SSLCertificateFile` in Apache) |
| `privkey.pem` | Private key (`ssl_certificate_key` / `SSLCertificateKeyFile`). Never share it. |

## How to check that renewal works

Let's Encrypt certificates currently last 90 days, and Let's Encrypt plans to cut this to 45 days by February 2028, so renewal must be automatic. Certbot installs a timer that checks twice a day and renews certificates that are close to expiry.

Run a test renewal against the staging server:

```bash theme={null}
sudo certbot renew --dry-run
```

It should end with `Congratulations, all simulated renewals succeeded`. See the timer:

```bash theme={null}
systemctl list-timers | grep certbot
```

The apt and EPEL packages use `certbot.timer`; the snap uses `snap.certbot.renew.timer`. List your certificates and expiry dates with:

```bash theme={null}
sudo certbot certificates
```

## Frequently asked questions

### Certbot says "Timeout during connect" or "Connection refused". Why?

Let's Encrypt could not reach port 80 on your server. Check that the DNS record points to this server, the web server is running and your firewall allows port 80. See [check if a port is open from outside](https://help.freakhosting.com/portals/other/how-to-check-if-a-port-is-open-from-outside.md).

### Can I get a wildcard certificate (\*.example.com)?

Yes, but only with the DNS challenge, which needs a TXT record per renewal. Use a Certbot DNS plugin for your DNS provider so renewals stay automatic.

### Do I need to restart Nginx after renewal?

No. The `--nginx` and `--apache` plugins reload the web server after renewing. With `certonly`, add `--deploy-hook "systemctl reload nginx"` so the new certificate is loaded.

### I use Caddy. Do I need Certbot?

No. Caddy gets and renews certificates by itself. See [install Caddy](https://help.freakhosting.com/portals/other/how-to-install-caddy-web-server.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every server guide in one place.

> [card] [Point a domain to your server](https://help.freakhosting.com/portals/other/how-to-point-a-domain-to-your-server.md)
>
> Set the A record first.

> [card] [Nginx server blocks](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-server-blocks.md)
>
> One config per domain.

> [card] [Nginx reverse proxy](https://help.freakhosting.com/portals/other/how-to-set-up-nginx-as-a-reverse-proxy.md)
>
> HTTPS in front of your app.

> [card] [Website not loading](https://help.freakhosting.com/portals/other/how-to-fix-website-not-loading-on-your-vps.md)
>
> Fix common errors.

***

> [!NOTE]
>
> **Checked against the official [Certbot instructions](https://certbot.eff.org/instructions?ws=nginx\&os=snap) and [Let's Encrypt certificate lifetime plans](https://letsencrypt.org/docs/cert-lifetimes/)** on 4 November 2026; Certbot 2.9.0 package names, plugin options and the `certbot.timer` unit checked on Ubuntu 24.04 LTS. Certificates were not issued in the test (no public domain). Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.