Welcome dear reader, today you will learn how to secure your website with a free SSL certificate from Let’s Encrypt. The little padlock in your browser’s address bar is no longer optional — browsers warn visitors about insecure sites, and Google ranks HTTPS pages higher. Certbot makes the whole process a matter of two commands, including automatic renewal.
Table of contents
- What is Let’s Encrypt and How Does It Work?
- How to Install Certbot
- How to Issue Your First SSL Certificate
- How Does Automatic Renewal Work?
- Conclusion
What is Let’s Encrypt and How Does It Work?
Let’s Encrypt is a free, automated certificate authority (CA). A certificate authority is the trusted organization that issues the SSL/TLS certificates proving that your domain really belongs to you — the foundation of HTTPS encryption.
Let’s Encrypt validates your domain through the ACME protocol: you run a small client, it proves you control the domain, and the CA signs your certificate. Certbot is that client, and it is the one most web admins use. The certificates are valid for 90 days, so automatic renewal — which Certbot sets up for you — is part of the deal.
How to Install Certbot
On Ubuntu and Debian, install Certbot together with the plugin for your web server. For Nginx, run:
# Install Certbot with the Nginx plugin sudo apt install certbot python3-certbot-nginx
For Apache 2, use the python3-certbot-apache plugin instead. Both plugins can edit your virtual host configuration automatically, which saves you from manual certificate wiring.
How to Issue Your First SSL Certificate
With Certbot installed, obtaining and installing a certificate is a single command:
# Obtain a certificate and configure Nginx automatically sudo certbot --nginx -d example.com -d www.example.com
Certbot will ask for your email address — used for expiry warnings — and to accept the terms of service. Behind the scenes it temporarily serves a small challenge file on your website to prove domain ownership, then obtains the certificate.
Before running the command, make sure your domain’s DNS already points to your server, and that port 80 is reachable from the internet. If you just set up your website following our guide on how to install WordPress on a VPS server, you are ready to go.
Once done, Certbot updates your server block so https:// works — and it redirects all HTTP traffic to HTTPS, which is the recommended behavior.
How Does Automatic Renewal Work?
Let’s Encrypt certificates expire after 90 days, but you do not have to remember anything. The Debian package ships a systemd timer that checks renewal twice a day:
# Verify that the renewal timer is active systemctl list-timers | grep certbot # Dry-run a renewal to test the setup sudo certbot renew --dry-run
If the dry run reports success, your certificates will be renewed automatically. Certbot even reloads your web server after each renewal, so the new certificates are picked up without downtime.
Conclusion
That’s already it to secure your website with Let’s Encrypt and Certbot. Install Certbot with your server’s plugin, run one command to obtain the certificate, and let the renewal timer keep it fresh forever — all free of charge. Leave a comment below if you have any questions or feedback about the content of this article.
At re:Software S.L., we create innovative solutions for businesses that aim to digitize their processes and routines, with privacy and integrity of data as a backbone of anything we do!