The quickest supported setup is to point your domain’s DNS records at the Ubuntu server, install Certbot from the snap package, and run sudo certbot --nginx -d example.com -d www.example.com. Certbot validates the names, edits the matching Nginx server block, installs the Let’s Encrypt certificate, and can redirect HTTP to HTTPS. Finish by testing renewal with sudo certbot renew --dry-run and checking the renewal timer.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What this setup does
Let’s Encrypt issues a publicly trusted TLS certificate after an ACME client proves control of each hostname. On Ubuntu, Certbot is the recommended ACME client in Ubuntu Server documentation. Its Nginx plugin performs the normal web-server workflow: it locates a matching enabled server block, obtains the certificate, writes the TLS directives, and reloads Nginx after a successful configuration.
As an Amazon Associate I earn from qualifying purchases.
The result is an HTTPS site at each name included with a -d option. If you select the redirect choice during setup, requests arriving over HTTP are sent to HTTPS. The certificate and key are managed under /etc/letsencrypt/, and the snap installation provides a systemd timer that attempts renewal automatically.
Prerequisites and preflight checks
Do these checks before installing Certbot. Most issuance failures are caused by DNS or by a server block that does not match the requested name.
- Ubuntu access: use an account that can run
sudo. - Nginx: Nginx must be installed and serving the site you intend to protect.
- DNS: create an A record for every IPv4 address you use and an AAAA record if the server is reachable over IPv6. Each requested hostname must resolve to this Ubuntu server.
- Firewall and security groups: allow inbound TCP port 80 for the normal HTTP-01 challenge and port 443 for the finished HTTPS service.
- Enabled configuration: the Nginx server block must be enabled, normally through a file in
/etc/nginx/sites-enabled/, and itsserver_namemust contain every name you will pass to Certbot.
Check DNS from a machine outside the server’s network when possible. A record that resolves correctly only inside a private DNS zone cannot be validated by the certificate authority.
Prepare the Nginx server block
Before Certbot edits anything, confirm that Nginx already has a site definition for the public names. A minimal HTTP block might look like this:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example;
index index.html;
}Use your actual document root and application settings. The important part for Certbot is that the requested names appear in server_name and that the file is enabled. Test the configuration before requesting a certificate:
sudo nginx -tIf the test succeeds, reload Nginx so the active configuration matches the file on disk:
sudo systemctl reload nginxDo not request a name that is handled by a different virtual host. If two server blocks claim the same name, Certbot may select the wrong one, and the resulting certificate can appear on an unexpected site.
Install Certbot from the snap package
Ubuntu’s current guidance uses the Certbot snap. Install it with:
Recommended Free Tools
sudo snap install --classic certbotSome systems do not place the snap command in a directory already listed in the shell’s PATH. Create the conventional link if the certbot command is not found:
sudo ln -s /snap/bin/certbot /usr/local/bin/certbotVerify that the executable responds before continuing:
certbot --versionThe snap is designed to track current Certbot releases and includes automated renewal preconfigured. You do not need to install a separate cron job for the standard Nginx workflow.
Obtain and install the certificate automatically
Run one command with a separate -d flag for every hostname that should be covered by the same certificate:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
sudo certbot --nginx -d example.com -d www.example.com- Certbot contacts the certificate authority and starts validation for each requested name.
- The Nginx plugin identifies the enabled server block whose
server_namematches those names. - For the normal HTTP-01 flow, Certbot temporarily configures the challenge location so the authority can reach it over port 80.
- After successful validation, Certbot writes the certificate and key references into the Nginx configuration.
- Certbot asks whether HTTP traffic should be redirected to HTTPS. Choose the redirect option if every page and endpoint should use HTTPS.
- The plugin tests and reloads Nginx after the configuration has been written.
When the command finishes, open https://example.com and https://www.example.com in a browser. Inspect the certificate details to confirm that the issuer and all requested subject-alternative names are present. Also test important application paths, API endpoints, redirects, and assets; a successful certificate issuance does not prove that an application is correctly configured for HTTPS.
Include every required name in one request
The certificate’s SAN set is determined by the names supplied during issuance. If visitors use both the apex domain and the www name, include both as shown above. Add other hostnames with additional -d flags in the same command rather than assuming a certificate for one name covers another.
What Certbot changes in Nginx
The --nginx mode is intended for hands-off configuration. It finds the matching virtual host, adds the certificate directives and related TLS settings, and reloads Nginx. Keep a record of the server block that Certbot changed so future edits are made in the correct enabled file.
After the command completes, run:
sudo nginx -t
sudo systemctl reload nginxThe first command catches syntax errors; the second applies a valid configuration without stopping active connections. If you later edit the file manually, always run the test before reloading.
Verify automatic renewal
Certificates obtained through Certbot must be renewed before they expire. The snap installation supplies a systemd timer that attempts renewal twice daily, while Certbot renews only when a certificate is within its renewal window. A successful renewal through the Nginx plugin reloads Nginx automatically, as documented by Ubuntu.
Test the complete renewal path without issuing or saving a production certificate:
sudo certbot renew --dry-runA successful dry run confirms that the renewal configuration can complete validation and perform its post-renewal actions. It does not replace monitoring: keep the output in your operational checks and investigate any reported challenge or network error.
Check the timer on a snap-based installation with:
sudo systemctl status snap.certbot.renew.timerIf the timer is inactive or failed, inspect its status and logs, then rerun the dry run after correcting the underlying issue. A timer that is enabled but unable to reach the authority still requires attention.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallManual Nginx control with certonly
Use this mode when you want Certbot to perform validation and store the certificate but you prefer to edit Nginx yourself:
sudo certbot certonly --nginx -d example.com -d www.example.comWith certonly, Certbot obtains the certificate without installing TLS directives in the server block. You then reference the live certificate files in your own HTTPS configuration:
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;The live directory contains stable paths that Certbot updates as certificates are renewed. Keep the private-key file readable only by the services and administrators that require it. After adding or changing the directives, validate and reload Nginx:
sudo nginx -t
sudo systemctl reload nginxManual mode gives you control over the complete TLS server block, but it also makes you responsible for preserving correct paths and ensuring that Nginx is reloaded after every successful renewal.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Choose the right ACME validation method
HTTP-01 is the usual choice for an Nginx website. Other methods are useful when port 80 cannot be reached, when another process owns the listener, or when you need a wildcard certificate.
| Method | Port-80 reachability | Nginx handling | Wildcard certificates | Extra requirements | Best fit |
|---|---|---|---|---|---|
HTTP-01 with --nginx |
The authority must reach the server on TCP 80. | Certbot temporarily configures the matching Nginx block and can install the final TLS settings. | Not supported for wildcard names. | Public DNS and an available HTTP listener. | Most conventional Nginx sites. |
| Standalone | TCP 80 must be reachable and free. | Certbot runs its own temporary web server; Nginx or another service may need to stop. | Not supported for wildcard names. | A free port 80 and permission to stop conflicting services. | Hosts where no existing web server should answer the challenge. |
| Webroot | The authority must reach TCP 80 through the existing site. | Certbot writes challenge files into the configured document root; you manage the Nginx configuration. | Not supported for wildcard names. | The correct document root and a route that serves challenge files. | Sites where Nginx must remain in full manual control. |
| DNS-01 | No inbound port 80 is required. | Certbot does not need to edit the HTTP listener for validation. | Supports wildcard certificates. | A Certbot DNS plugin and API credentials or another supported method for changing DNS records. | Wildcard names, private origins, or hosts that cannot accept HTTP connections. |
The exact DNS-01 command depends on the DNS provider’s Certbot plugin. Protect any DNS API credential with the same care as a server secret, because it can alter the records that control your domain.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.When HTTP-01 validation fails
Port 80 is blocked
Confirm that the host firewall, cloud security group, load balancer, and upstream network all allow inbound TCP 80. HTTP-01 cannot succeed if the certificate authority is unable to connect, even when HTTPS on port 443 works for you.
DNS points somewhere else
Recheck every A and AAAA record for the requested name. An outdated AAAA record can send IPv6 validation to a different server while IPv4 appears correct. Remove or correct records that do not lead to the Nginx host, then wait for the authoritative DNS data to update before retrying.
Free tools Windows power users keep installed
One-click scans. No signup required.
Another service intercepts the hostname
Make sure a proxy, load balancer, container, or second web server is not answering the challenge request. The authority must receive the token that Certbot placed for the intended hostname. If another service must remain in front, configure it to pass the challenge path to this Nginx instance or select a validation method appropriate to that architecture.
When Certbot selects the wrong server block
List the enabled sites and inspect their names:
ls -l /etc/nginx/sites-enabled/
grep -R "server_name" /etc/nginx/sites-enabled/Confirm that the requested names appear only in the intended block. Run:
sudo nginx -tCorrect duplicate or stale configurations, enable the proper site, and reload Nginx before running Certbot again. A certificate can be issued successfully while still being served by an unexpected virtual host if the name-to-block mapping is wrong.
Renewal failures and service reloads
Start with the safe test:
sudo certbot renew --dry-runRead the reported challenge, hostname, and listener details rather than repeatedly retrying. Correct DNS, firewall rules, expired credentials, or port conflicts, then test again. Check the timer status with:
sudo systemctl status snap.certbot.renew.timerFor Nginx configurations managed by Certbot’s Nginx plugin, a successful renewal triggers an automatic Nginx reload. Services outside the Nginx or Apache plugin flow do not receive that reload automatically. Add a deploy hook at /etc/letsencrypt/renewal-hooks/deploy/reload-service.sh that runs systemctl reload <your-service> for the affected service, and make sure the hook is executable and safe to run repeatedly.
Operational checklist
- Verify every A and AAAA record before issuance and after moving the server.
- Keep all required hostnames in the certificate request with individual
-doptions. - Run
sudo nginx -tbefore every reload. - Choose the HTTP-to-HTTPS redirect during installation when the application is ready to serve all required paths over HTTPS.
- Run
sudo certbot renew --dry-runafter initial setup and whenever DNS, firewall, proxy, or Nginx routing changes. - Monitor
snap.certbot.renew.timerand its logs instead of assuming scheduled renewal succeeded. - If you use
certonly, keep the/etc/letsencrypt/live/<domain>/paths in your Nginx configuration and arrange a reload after renewal. - For multiple services or wildcard names, select DNS-01 only when you can securely automate the required DNS changes.
Choosing between the two Nginx workflows
| Workflow | Command | Who edits Nginx? | Who handles reload after renewal? | Use it when |
|---|---|---|---|---|
| Automatic installation | sudo certbot --nginx -d example.com -d www.example.com |
Certbot adds and maintains the initial TLS directives. | The Nginx plugin reloads Nginx after successful renewal. | You want the shortest supported setup and are comfortable with Certbot modifying the matching server block. |
| Certificate only | sudo certbot certonly --nginx -d example.com -d www.example.com |
You write and maintain the HTTPS server block using the files under /etc/letsencrypt/live/. |
You must ensure the service reloads after renewal. | You have a custom Nginx layout, infrastructure-as-code workflow, or strict manual control requirements. |
For a single Ubuntu Nginx site, automatic installation is usually the least error-prone path. Select certonly when the configuration itself is managed elsewhere and an automated edit would conflict with your deployment process.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
