How to Install Let’s Encrypt SSL on Ubuntu with Certbot Print

Let’s Encrypt provides free SSL/TLS certificates that allow you to secure your website with HTTPS.

This guide explains how to install a Let’s Encrypt SSL certificate on an Ubuntu server using Certbot.

Before You Start

Make sure you have:

• An Ubuntu server
• Root or sudo access
• A registered domain name
• Your domain pointing to the server’s public IP address
• Port 80 and 443 accessible

You can check your server IP with:

ip addr

Before requesting the certificate, your domain’s DNS record must point to the correct server.

Step 1: Update Ubuntu

Update the package list:

sudo apt update

Optionally install available updates:

sudo apt upgrade -y

Step 2: Install Certbot

Install Certbot:

sudo apt install certbot -y

If you are using Nginx, install the Nginx plugin:

sudo apt install python3-certbot-nginx -y

If you are using Apache:

sudo apt install python3-certbot-apache -y

Step 3: Check Your Domain DNS

Before requesting the SSL certificate, verify that your domain resolves to the server.

For example:

dig example.com

You can also use:

getent hosts example.com

Replace example.com with your domain.

The returned IP address should match the server where you are installing the certificate.

Step 4: Install SSL with Nginx

If your website uses Nginx, run:

sudo certbot --nginx -d example.com -d www.example.com

Replace example.com with your domain.

Certbot will:

• Request the SSL certificate
• Validate your domain
• Install the certificate
• Configure Nginx
• Enable HTTPS

Follow the instructions displayed by Certbot.

Step 5: Install SSL with Apache

If your website uses Apache:

sudo certbot --apache -d example.com -d www.example.com

Certbot will request the certificate and configure Apache automatically.

Install SSL Without Nginx or Apache Plugin

Certbot can also request a certificate using standalone mode.

First, make sure port 80 is available.

Then run:

sudo certbot certonly --standalone -d example.com

If you also need www:

sudo certbot certonly --standalone -d example.com -d www.example.com

In standalone mode, Certbot temporarily starts its own web server for domain validation.

If another application is already using port 80, you may need to stop it temporarily or use another validation method.

Step 6: Check the Certificate

List certificates managed by Certbot:

sudo certbot certificates

You should see information including:

Certificate Name
Domains
Expiry Date
Certificate Path
Private Key Path

Step 7: Test HTTPS

Open your website using:

https://example.com

You can also test the HTTPS response from the command line:

curl -I https://example.com

If everything is configured correctly, your website should respond over HTTPS.

Automatic SSL Renewal

Let’s Encrypt certificates have a limited validity period, so automatic renewal is important.

Certbot normally configures automated renewal during installation.

Check the Certbot timer:

systemctl status certbot.timer

You can also test the renewal process without actually renewing the certificate:

sudo certbot renew --dry-run

If the test completes successfully, automatic renewal should work correctly.

Manually Renew Certificates

To manually attempt renewal:

sudo certbot renew

Certbot will only renew certificates that are close enough to expiration.

Open HTTP and HTTPS Ports with UFW

If UFW is enabled, check the current firewall rules:

sudo ufw status

For Nginx, you can allow HTTP and HTTPS using:

sudo ufw allow 'Nginx Full'

Alternatively:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Before modifying firewall rules on a remote server, make sure SSH access remains allowed.

Common Let’s Encrypt Problems

Domain Does Not Point to the Server

If the domain resolves to the wrong IP address, Let’s Encrypt validation may fail.

Check:

dig example.com

Update the DNS A or AAAA record if necessary.

DNS changes may require time to propagate.

Port 80 Is Blocked

HTTP-based validation normally requires Let’s Encrypt to reach your server.

Check whether a service is listening on port 80:

sudo ss -ltnp | grep ':80'

Also check your firewall:

sudo ufw status

Nginx Configuration Error

Test the Nginx configuration:

sudo nginx -t

If errors are reported, fix them before running Certbot again.

Reload Nginx after correcting the configuration:

sudo systemctl reload nginx

Apache Configuration Error

Check Apache configuration:

sudo apache2ctl configtest

If the configuration is valid, you should see:

Syntax OK

Where Are Let’s Encrypt Certificates Stored?

Certbot normally stores certificates under:

/etc/letsencrypt/live/

For example:

/etc/letsencrypt/live/example.com/

This directory contains links to the certificate and private key files.

Do not expose or publicly share your private key.

Check Certificate Expiration

You can view Certbot certificate information with:

sudo certbot certificates

You can also inspect the certificate using OpenSSL:

openssl s_client -connect example.com:443 -servername example.com </dev/null 2>/dev/null | openssl x509 -noout -dates

Keep Your Server Secure

SSL protects traffic between users and your web server, but it does not secure the entire server.

You should also:

• Keep Ubuntu updated
• Configure a firewall
• Secure SSH access
• Use strong passwords or SSH keys
• Install security updates
• Disable unnecessary services
• Monitor server activity

IDONCLOUD Server Infrastructure

IDONCLOUD provides VPS and Dedicated Server infrastructure for websites, applications and other Linux workloads.

Our Knowledge Base provides practical guides for configuring Linux servers, networking, domains and SSL.

Visit idoncloud.com to explore IDONCLOUD infrastructure.

Related Guides

• How to Point a Domain Name to Your Server
• How to Install Nginx on Ubuntu
• How to Configure a Domain with Nginx
• How to Redirect HTTP to HTTPS
• How to Check Open Ports on a Linux Server
• How to Configure UFW Firewall on Ubuntu