What I Wanted to Do

I wanted to set up an SSL certificate on nginx running on a VPS so it could be accessed over HTTPS. Let’s Encrypt certificates are free and can be obtained easily with certbot.

Installing certbot

# Ubuntu / Debian
sudo apt update
sudo apt install -y certbot python3-certbot-nginx

Obtaining an SSL Certificate

sudo certbot --nginx -d example.com -d www.example.com

It runs interactively — just enter your email address and choose to redirect HTTP to HTTPS.

Enter email address: your@email.com
(A)gree/(C)ancel: A
(Y)es/(N)o: N
Select the appropriate number [1-2]: 2

nginx Config Gets Updated Automatically

certbot automatically rewrites the nginx configuration file.

server {
    listen 443 ssl;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    location / {
        root /var/www/html;
        index index.html;
    }
}

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Automatic Certificate Renewal

Let’s Encrypt certificates expire after 90 days. certbot handles automatic renewal via a systemd timer.

# Test auto-renewal
sudo certbot renew --dry-run
# Check the timer status
sudo systemctl status certbot.timer

Common Commands

# List certificates
sudo certbot certificates

# Manually renew certificates
sudo certbot renew

# Delete a specific certificate
sudo certbot delete --cert-name example.com

# Test nginx config syntax
sudo nginx -t

# Reload nginx
sudo systemctl reload nginx

Gotchas

  • Certificate retrieval fails if port 80 is closed — open it with ufw first
  • When using Cloudflare, set the cloud icon to grey (DNS only) before running certbot
  • Specify both www. and non-www. with -d, otherwise one won’t have HTTPS
  • If server_name isn’t set correctly in nginx, certbot won’t recognize the site
  • DNS for the domain must point to the VPS IP, otherwise the challenge will fail

Looking for reliable cloud infrastructure? Check out these developer-friendly services.