The reliable way to put a Let’s Encrypt certificate on an Nginx site is to make the domain reachable on port 80, create an HTTP server block with the exact server_name, and let Certbot obtain and install the certificate with sudo certbot --nginx. Certbot can also obtain the certificate without changing Nginx when you use sudo certbot certonly --nginx; that mode is useful when you want to review every redirect, proxy rule, and certificate path yourself.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
After issuance, Nginx needs an SSL-enabled listener on port 443 that names the certificate and private key. Keep a port-80 listener as well: it serves ordinary HTTP requests, supports HTTP-01 validation, and can redirect normal page requests to HTTPS without blocking the ACME challenge path.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What you need before running Certbot
Certificate issuance is a reachability test as much as a configuration task. The validation service must be able to resolve your domain and fetch a challenge file from your Nginx host over the public Internet.
Point every required DNS name at this server
Create an A record for each IPv4 name and an AAAA record only when that IPv6 address really reaches this Nginx instance. Include every name you intend to place in the certificate, such as the bare domain and its www name. Check that the records resolve to the intended host before starting Certbot. A stale A or AAAA record can send validation to a different machine even when the Nginx configuration is perfect.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Expose TCP ports 80 and 443
Allow inbound TCP 80 and 443 in the operating-system firewall, cloud security group, load balancer, and any NAT rule in front of the server. The standard Nginx and webroot workflows expect an HTTP site that is reachable on port 80. Port 443 is needed once the certificate is installed. If IPv6 is advertised, permit the same ports on the IPv6 path and verify that it terminates at this host.
Have Nginx serving the site over HTTP
Install Nginx and create an enabled HTTP server block whose server_name exactly matches the requested names. Set the correct document root or proxy target before invoking Certbot. A request for the domain should already reach this block and return your site, rather than a default virtual host or another application.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the HTTP-01 challenge works
For each name, Certbot creates a short-lived token. The validation service requests http://your-domain/.well-known/acme-challenge/<TOKEN> on port 80 and checks the response. HTTP-01 may follow redirects, but only to HTTP or HTTPS on ports 80 or 443. A redirect to a different port, an authentication wall, or an application route that does not return the token causes issuance to fail.
That behavior explains why port 80 should remain available even on an HTTPS-only site. A blanket redirect is fine for ordinary pages, provided the /.well-known/acme-challenge/ location remains publicly readable and is served from the expected web root. Let’s Encrypt’s published guidance puts it plainly: “Our recommendation is that all servers meant for general web use should offer both HTTP on port 80 and HTTPS on port 443.”
Build the initial HTTP server block
Use the same names, root, and application behavior that the live site should have. The following pattern keeps the challenge directory outside the redirect and sends all other HTTP requests to HTTPS.
server {
listen 80;
listen [::]:80;
server_name example.com www.example.com;
root /var/www/example;
location /.well-known/acme-challenge/ {
root /var/www/example;
}
location / {
return 301 https://$host$request_uri;
}
}Replace the example names and path with your deployment values. If the application is reverse-proxied, keep the proxy configuration in the normal location and make the challenge location serve files directly from a directory that Nginx can read. Do not protect that location with login, IP restrictions, or a rule that rewrites the token into your application.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Check the block before requesting a certificate
- Save the block in the location used by your distribution for enabled Nginx sites.
- Confirm that the exact domain names appear in
server_name, including every name you will pass to Certbot. - Place a temporary file below
/.well-known/acme-challenge/and request it from an outside network. The response must be the file contents, not a redirect to an unrelated host or an application error. - Run
sudo nginx -t. Fix every syntax or include error before continuing. - Reload Nginx with
sudo systemctl reload nginx(or the equivalent command on your platform).
Choose Certbot’s installation mode
Certbot’s Nginx plugin can act as both an authenticator and an installer. The two practical modes differ in who edits the server blocks after validation.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
| Command | What it does | When to choose it |
|---|---|---|
sudo certbot --nginx |
Obtains the certificate through Nginx and edits the Nginx configuration to install it and, when selected, add redirects. | Fastest setup when you are comfortable reviewing Certbot’s changes. |
sudo certbot certonly --nginx |
Uses Nginx for validation and obtains the certificate, but leaves installation and final server-block editing to you. | Best when you need precise control over redirects, proxy behavior, includes, or deployment review. |
Run the selected command as root. Certbot will ask which names to include when several are available. Select only names whose DNS records already reach this host. If the command reports a challenge failure, do not repeatedly retry; use the troubleshooting checks below to correct DNS, port access, or the challenge location first.
Review the HTTPS server block
After successful issuance, inspect the resulting configuration rather than assuming the installer made the layout you want. The essential requirements are a 443 listener with SSL enabled, the same intended server_name values, and paths to the certificate chain and private key.
server {
listen 443 ssl;
listen [::]:443 ssl;
server_name example.com www.example.com;
root /var/www/example;
ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
location / {
try_files $uri $uri/ =404;
}
}fullchain.pem presents the server certificate together with the intermediate chain; privkey.pem is the corresponding private key. The directory name under /etc/letsencrypt/live/ is the certificate name chosen by Certbot and may differ from the domain if a previous certificate used that name. Keep these managed paths unchanged unless you have a documented deployment reason to copy them elsewhere. If you do copy them, your renewal process must also copy the new files and reload Nginx.
Preserve the port-80 block
Do not remove the HTTP listener after enabling HTTPS. Keep the challenge location available and redirect only ordinary requests:
location /.well-known/acme-challenge/ {
root /var/www/example;
}
location / {
return 301 https://$host$request_uri;
}Using $host and $request_uri preserves the requested hostname and path. If your policy requires one canonical hostname, make that redirect deliberate, and verify that every certificate name still resolves to the host that answers the challenge.
Validate and activate the configuration
- Run
sudo nginx -t. Nginx must report a successful syntax test and that the configuration test is successful. - Reload with
sudo systemctl reload nginx. A reload applies the new listeners without stopping existing connections. - From an external network, open each HTTPS name and inspect the certificate identity and expiry. Confirm that the certificate covers the exact hostname in the address bar.
- Request the HTTP URL and verify that a normal page redirects to the corresponding HTTPS URL.
- Request a known file under
/.well-known/acme-challenge/over HTTP while testing, then remove the temporary file. It must remain reachable without authentication or an application rewrite.
If nginx -t fails, do not reload. Typical causes are a duplicated 443 listener, a missing semicolon, a certificate path that does not exist, or a private-key file that Nginx cannot read. Correct the configuration and repeat the test.
Set up and verify automatic renewal
Let’s Encrypt certificates are short-lived, so issuance is only half the job. Packages that install Certbot normally provide a scheduled cron job or systemd timer that runs renewal before expiry. Check which mechanism your package installed and ensure it is enabled.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
- Run the renewal test recommended by your Certbot package. On installations that support it,
sudo certbot renew --dry-runperforms a simulated renewal against the staging service. - Review the command output for successful authentication and deployment. A renewal that obtains files but does not reload Nginx leaves the running worker with the old certificate.
- If you manage certificate files outside Certbot’s live directory, add a deploy hook or equivalent step that updates the copy and reloads Nginx only after a successful renewal.
- Monitor the timer or cron logs and check the certificate expiry periodically from outside the server.
The scheduled job may run daily even though renewal occurs only when a certificate is close enough to expiry. That is normal; the important result is that a due certificate is renewed and Nginx is reloaded with the new files.
Troubleshoot common validation failures
“Connection refused” or timeout on port 80
Check the host firewall, cloud security group, load balancer listener, and NAT rule. Confirm that Nginx is listening on the public interface, not only on loopback, and that the DNS A and AAAA records point to this server. If an AAAA record exists but IPv6 routing is incomplete, validators may reach the broken IPv6 path; fix IPv6 or remove the incorrect record.
The challenge returns your homepage, a 404, or an application response
The request is probably being handled by the wrong server block or by a catch-all application route. Verify the exact server_name, make sure the challenge location is present in the active configuration, and place the token directory under the root used by that location. A blanket rewrite, access rule, or authentication middleware must not intercept the path.
HTTP redirects to an unsupported destination
HTTP-01 accepts redirects only to HTTP or HTTPS on ports 80 or 443. Remove redirects to alternate ports, an IP address, or a hostname that does not serve the challenge. Keep the challenge location ahead of broad redirect logic and test it directly over HTTP.
Another process already owns port 80
Standalone validation requires Certbot to bind the port itself, so it cannot work while another service owns that socket unless the service is stopped. The Nginx plugin or a webroot-style arrangement validates through the existing web server and avoids that replacement workflow. Identify the process using port 80 before changing services.
The HTTPS site shows the wrong certificate
Inspect the active 443 server block and the certificate name under /etc/letsencrypt/live/. Multiple server blocks, an old certificate copied to another path, or a load balancer terminating TLS can make the browser see a different certificate than the one Certbot renewed. Test the public endpoint, not only a local file.
When you need a wildcard certificate
HTTP-01 cannot issue wildcard names. A wildcard such as *.example.com requires DNS-01 validation, which proves control by creating a DNS TXT record. DNS-01 does not require inbound access to a web server, making it suitable for private services, multi-host deployments, or environments where port 80 cannot be exposed.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
DNS-01 is operationally different: you need an automated DNS API plugin or the ability to create the required TXT record manually, and you must protect the DNS credentials because they can alter the domain’s records. Use HTTP-01 for ordinary hostnames when port 80 is available; choose DNS-01 when wildcard coverage or non-public hosts justifies the extra DNS control.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDecide how much configuration control you want
- Use
certbot --nginxwhen speed matters. It can create the 443 block and redirect rules for you, but you should still inspect the diff and runnginx -tbefore reloading. - Use
certbot certonly --nginxwhen policy or architecture is complex. You retain control over proxy headers, canonical-host redirects, shared includes, and certificate deployment. - Use DNS-01 for wildcards or unreachable web servers. It removes the port-80 requirement but adds DNS API or TXT-record management.
Whichever path you choose, document the certificate names, the managed file paths, the renewal timer, and the command that reloads Nginx. That record prevents a future administrator from deleting the port-80 block or replacing Certbot’s managed paths without updating renewal.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Match certificate names to Nginx server blocks
Each requested name must be represented consistently in DNS, the Certbot selection, and the active Nginx configuration. If you request both example.com and www.example.com, list both in server_name on the HTTP block and on the HTTPS block unless you intentionally route one name elsewhere. A certificate can cover a name while Nginx still sends that name to a different virtual host; the browser then receives the wrong content even though TLS validation succeeds.
When several sites share one address, check which block Nginx considers the default for port 80 and for port 443. The challenge request must land in the block containing the matching server_name and challenge location. Likewise, the HTTPS request must select the block whose certificate contains the hostname. Review enabled-site symlinks and included files if the configuration appears correct but the public response is not.
Keep certificate deployment predictable
Certbot maintains stable paths in /etc/letsencrypt/live/ while renewing the underlying certificate files. Point Nginx at those managed paths whenever possible. Copying files into an application directory can work, but it creates a second deployment step: the renewal job must copy the replacement files and then reload Nginx. Without that hook, Certbot may report a successful renewal while the public server continues using the previous certificate.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteMake configuration changes in a reviewable order: inspect the generated diff, run sudo nginx -t, reload only after a successful test, and then test the public endpoint. This sequence catches a missing file, duplicate listener, or malformed include before it interrupts the running service. Keep a record of the certificate lineage or certificate name so that a future administrator does not point the server at a similarly named but outdated directory.
Plan for firewalls, proxies, and IPv6
Port checks must follow the complete traffic path. A local firewall rule is not enough when a cloud security group, reverse proxy, load balancer, or NAT device sits in front of Nginx. The front-end device must pass HTTP-01 requests to the host that owns the HTTP server block, and it must pass HTTPS traffic to the endpoint serving the renewed certificate. If TLS terminates at a load balancer, renewals on the Nginx host do not automatically change the certificate shown to visitors; the terminating device needs its own deployment process.
An AAAA record is an active routing promise. If it points to a host that does not answer on port 80, validation can fail even when the A record and IPv4 firewall are correct. Either complete the IPv6 listener and firewall path or remove the incorrect AAAA record until it is usable. Test from outside the server so that local DNS overrides and loopback access do not hide a public routing problem.
A final operational checklist
- All A and AAAA records resolve to the intended Nginx host.
- TCP 80 and 443 are allowed through every firewall and forwarding layer.
- The HTTP
server_nameexactly matches the requested certificate names. /.well-known/acme-challenge/is served without authentication or a destructive rewrite.- The HTTPS block listens on 443 with SSL and references the correct
fullchain.pemandprivkey.pem. sudo nginx -tsucceeds before every reload.- External tests show the expected certificate and an HTTP-to-HTTPS redirect for normal pages.
- The packaged renewal timer or cron job is enabled, and a simulated renewal succeeds.
Frequently Asked Questions
Can I remove port 80 after the certificate is installed?
Keep port 80 available. Let’s Encrypt’s HTTP-01 validation uses the URL under /.well-known/acme-challenge/, and normal HTTP requests can still receive a 301 redirect to HTTPS. Exempt the challenge location from the redirect’s application or authentication rules.
What is the difference between certbot --nginx and certbot certonly --nginx?
The first command obtains the certificate and edits Nginx to install it, with redirect options during the run. The certonly form performs authentication and issuance but leaves the 443 block, certificate paths, and redirects for you to configure and review.
Why does a challenge fail when the website works in my browser?
A browser test may use a cached address or a different address family. Check the public A and AAAA records, every firewall and forwarding layer, and the exact port-80 server block. Then fetch a temporary file from /.well-known/acme-challenge/ over an external network.
Can HTTP-01 follow my HTTP-to-HTTPS redirect?
Yes, but only to HTTP or HTTPS on ports 80 or 443. Redirects to another port, an IP address, an unrelated hostname, a login page, or an application route that hides the token can fail validation.
How do I renew a certificate without taking Nginx offline?
Keep the packaged Certbot cron job or systemd timer enabled and test it with sudo certbot renew --dry-run when supported. A successful renewal must be followed by an Nginx reload so workers read the new files. A deploy hook is appropriate when you copy certificates outside Certbot’s managed directory.
Recommended Free Tools
Which validation method supports a wildcard such as *.example.com?
Use DNS-01. It requires control of DNS through an API plugin or manual TXT-record changes and does not require inbound web-server access. HTTP-01 is for ordinary hostnames and cannot issue wildcard names.
What should I check if Nginx serves the wrong certificate?
Inspect the active 443 server block, its server_name, and the exact directory under /etc/letsencrypt/live/. Check for another enabled server block, a copied old certificate, or a load balancer that terminates TLS before traffic reaches this Nginx host.
The Bottom Line
Point every certificate name to the Nginx host, expose ports 80 and 443, and make the HTTP challenge path reachable before running Certbot. Use certbot --nginx for an automated install or certbot certonly --nginx for manual server-block control. Keep the port-80 challenge location, validate with nginx -t before each reload, and verify that the renewal timer reloads the certificate actually served to visitors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
