SSL/TLS certificates encrypt the connection between your server and visitors, protecting sensitive data and establishing trust. Modern browsers flag sites without SSL as "Not Secure," and search engines favor HTTPS sites in rankings. This guide covers installing free Let's Encrypt certificates and managing their renewal.

Why You Need SSL

• Encryption — Protects data in transit (passwords, credit cards, personal information).
• Trust — Browsers show a padlock icon for HTTPS sites.
• SEO — Search engines prioritize HTTPS sites in rankings.
• Compliance — Many regulations require encrypted data transmission.
• Modern standards — HTTP/2 and HTTP/3 require HTTPS.

Installing Let's Encrypt with Certbot

Let's Encrypt provides free, trusted SSL certificates. Certbot is the recommended tool for obtaining and managing them.

Ubuntu / Debian

# Install Certbot
sudo apt update
sudo apt install certbot -y
For Apache
sudo apt install python3-certbot-apache -y
For Nginx
sudo apt install python3-certbot-nginx -y

CentOS / AlmaLinux

sudo dnf install epel-release -y
sudo dnf install certbot -y
For Apache
sudo dnf install python3-certbot-apache -y
For Nginx
sudo dnf install python3-certbot-nginx -y

Obtaining a Certificate

For Nginx

sudo certbot --nginx -d example.com -d www.example.com

Certbot will:

For Apache

sudo certbot --apache -d example.com -d www.example.com

Standalone Mode

If you are not using Apache or Nginx, or want manual control:

sudo certbot certonly --standalone -d example.com -d www.example.com

This temporarily starts a web server on port 80 for domain verification. Your existing web server must be stopped during this process.

DNS Verification (Wildcard Certificates)

For wildcard certificates (*.example.com):

sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

You will be prompted to create a DNS TXT record for verification.

Certificate Files

After obtaining a certificate, files are stored at:

/etc/letsencrypt/live/example.com/
  fullchain.pem   # Certificate + intermediate certificates
  privkey.pem     # Private key
  cert.pem        # Certificate only
  chain.pem       # Intermediate certificates

Manual Nginx Configuration

If you need to configure Nginx manually:

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    # Strong SSL configuration
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    # HSTS (optional but recommended)
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    root /var/www/example.com/public_html;
    index index.html index.php;
}
Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Auto-Renewal

Let's Encrypt certificates expire every 90 days. Certbot sets up automatic renewal:

Test Renewal

sudo certbot renew --dry-run

If the dry run succeeds, auto-renewal is configured correctly.

How Auto-Renewal Works

Certbot installs a systemd timer or cron job that checks for renewals twice daily. Certificates are renewed when they are within 30 days of expiration.

Verify the timer is active:

sudo systemctl status certbot.timer

Manual Renewal

sudo certbot renew

Verifying Your SSL Certificate

In the Browser

From the Command Line

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -dates

This shows the certificate's validity dates.

Troubleshooting

Certificate Not Trusted

• Ensure you are using fullchain.pem (not cert.pem) in your web server configuration.
• Verify the certificate has not expired.

Renewal Failed

• Check that port 80 is accessible from the internet.
• Ensure DNS records point to the correct server.
• Review Certbot logs: sudo cat /var/log/letsencrypt/letsencrypt.log

Mixed Content Warnings

After enabling HTTPS, ensure all resources (images, scripts, stylesheets) use HTTPS URLs. Update hardcoded http:// references in your application.

What to Do Next

• Server Firewall Hardening Guide — Ensure ports 80 and 443 are open.
• Server Networking — IPs, DNS, Reverse DNS — Configure DNS for your domain.
• Complete Server Security Checklist — Full security review.
• DDoS Protection — Protect your HTTPS endpoints.