Let's Encrypt: Free SSL in 5 Minutes (Apache, Nginx)

Let's Encrypt has transformed the web in just a few years: free SSL certificates, automatic renewal, and wildcard support are all available at no cost. In 2026 there is no reason to leave a site on HTTP. This guide covers installing certificates on Apache and Nginx with Certbot, configuring auto-renewal, and resolving common problems.

Before you begin, make sure your domain points to your server (the A record is configured) and ports 80 and 443 are open. Check the current SSL status using the SSL checker. For long-term monitoring of certificate expiration, use SSL Monitor.

What is Let's Encrypt

A brief history

Let's Encrypt is a nonprofit certificate authority (CA), launched in 2015 with support from Mozilla, Cisco, Google, and others. Its goal is to make HTTPS accessible to everyone. Billions of certificates have been issued over the years. Certificates are valid for 90 days (previously 60), encouraging renewal automation.

Features

Parameter	Value
Cost	Free
Validity period	90 days
Validation type	DV (Domain Validation)
Wildcard	Yes (via DNS challenge)
Certificate limit	50 per domain per week
Duplicate limit	5 per week

ACME protocol

Let's Encrypt uses the ACME (Automated Certificate Management Environment) protocol to automate certificate issuance. Certbot is the most popular ACME client, supporting HTTP-01 and DNS-01 challenges for domain validation.

Installing Certbot

Ubuntu / Debian

CodeShell

# Обновление пакетов
sudo apt update

# Установка Certbot и плагина для Nginx или Apache
# Для Nginx:
sudo apt install certbot python3-certbot-nginx -y

# Для Apache:
sudo apt install certbot python3-certbot-apache -y

# Только Certbot (без плагинов, для ручной настройки):
sudo apt install certbot -y

CentOS / RHEL / Rocky Linux

CodeShell

# Установка EPEL (если не установлен)
sudo dnf install epel-release -y

# Certbot для Nginx
sudo dnf install certbot python3-certbot-nginx -y

# Certbot для Apache
sudo dnf install certbot python3-certbot-apache -y

Verify the installation

CodeShell

certbot --version
# certbot 2.x.x

Installing a certificate on Nginx

Automatic mode (recommended)

Certbot can configure Nginx itself: add a location block for the ACME challenge and configure SSL.

CodeShell

# Один домен
sudo certbot --nginx -d example.com

# Несколько доменов (один сертификат)
sudo certbot --nginx -d example.com -d www.example.com

# Интерактивный режим: email для уведомлений, согласие с ToS

Certbot will ask for:

An email address for expiration notifications
Agreement to the terms of service
Optionally, an HTTP → HTTPS redirect (recommended)

Manual Nginx configuration

If you prefer full control, configure Nginx manually and use certbot certonly.

Step 1. Set up a temporary server for the ACME challenge:

CodeNginx

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/html;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

Step 2. Create a directory and obtain the certificate:

CodeShell

sudo mkdir -p /var/www/html/.well-known/acme-challenge
sudo chown -R www-data:www-data /var/www/html
sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

Step 3. Add an SSL block to Nginx:

CodeNginx

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Рекомендуемые настройки SSL (см. раздел ниже)
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/html;
    index index.html;
    # ... остальная конфигурация
}

Step 4. Reload Nginx:

CodeShell

sudo nginx -t
sudo systemctl reload nginx

Full Nginx configuration with SSL

CodeNginx

# Редирект HTTP → HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/html;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

Installing a certificate on Apache

Automatic mode

CodeShell

sudo certbot --apache -d example.com -d www.example.com

Certbot will automatically:

Find virtual hosts
Add SSL configuration
Configure a redirect (if you choose one)

Manual Apache configuration

Step 1. Enable the SSL and rewrite modules:

CodeShell

sudo a2enmod ssl rewrite
sudo systemctl restart apache2

Step 2. Obtain the certificate:

CodeShell

sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

Step 3. Create a virtual host for HTTPS:

CodeApache

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    <Directory /var/www/html>
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

Step 4. Redirect HTTP → HTTPS:

CodeApache

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Step 5. Restart Apache:

CodeShell

sudo apache2ctl configtest
sudo systemctl restart apache2

Wildcard certificates (DNS challenge)

Subdomains such as *.example.com require DNS validation: Let's Encrypt verifies that you control the domain through a TXT record.

Obtaining a wildcard certificate

CodeShell

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

Certbot will display instructions:

CodeText

Please deploy a DNS TXT record under the name _acme-challenge.example.com with the following value:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Before continuing, verify the record is deployed.

Actions:

Create a TXT record _acme-challenge.example.com with the specified value
Wait for DNS propagation (1–10 minutes; check using dig TXT _acme-challenge.example.com)
Press Enter in Certbot

Automating the DNS challenge

To automatically renew wildcard certificates, use plugins:

certbot-dns-cloudflare — for Cloudflare
certbot-dns-route53 — for AWS Route 53
certbot-dns-google — for Google Cloud DNS

Example for Cloudflare:

CodeShell

sudo apt install python3-certbot-dns-cloudflare -y

Create a file containing the API token:

CodeINI

# /etc/letsencrypt/cloudflare.ini
dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN

CodeShell

chmod 600 /etc/letsencrypt/cloudflare.ini
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini -d example.com -d "*.example.com"

Certificate auto-renewal

Certbot system timer

Certbot creates a systemd timer for automatic renewal. Check its status:

CodeShell

sudo systemctl status certbot.timer
sudo systemctl list-timers | grep certbot

Renewal runs twice a day. Certbot renews certificates 30 days before they expire.

Run renewal manually

CodeShell

# Сухой прогон (без реального обновления)
sudo certbot renew --dry-run

# Реальное обновление
sudo certbot renew

Reload the web server after renewal

By default, Certbot reloads Apache/Nginx after renewal. For custom scripts, use hooks:

CodeShell

# /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
#!/bin/bash
systemctl reload nginx

CodeShell

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Cron as a fallback

If systemd is unavailable:

CodeCron

0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

Recommended SSL settings

Modern protocols and ciphers

Certbot creates a file, options-ssl-nginx.conf (or options-ssl-apache.conf), with recommended settings. Key parameters:

Nginx:

CodeNginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

Apache:

CodeApache

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

HSTS (optional)

Adds the Strict-Transport-Security header to enforce HTTPS in the browser:

Nginx:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache:

CodeApache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Check security headers using the Security Headers checker.

Common problems and solutions

Error: "Could not find a virtual host"

Certbot could not find a suitable virtual host. Make sure the configuration specifies the correct server_name (Nginx) or ServerName (Apache) for your domain.

Error: "Connection refused" on port 80

Make sure the web server is listening on port 80 and that the firewall is not blocking it:

CodeShell

sudo ss -tlnp | grep :80
sudo ufw status

Error: "DNS problem: NXDOMAIN"

The domain does not resolve. Check the A record:

CodeShell

dig example.com +short

Rate limit exceeded

Let's Encrypt limits issuance to 50 certificates per domain per week and 5 duplicates per week. If you exceed the limit, you must wait. Use --dry-run for testing to avoid using up the limit.

Certificate does not renew

Check the logs:

CodeShell

sudo journalctl -u certbot.timer
sudo certbot renew --dry-run -v

Make sure port 80 is accessible from outside (for the HTTP-01 challenge).

Let's Encrypt file structure

CodeText

/etc/letsencrypt/
├── live/example.com/
│   ├── cert.pem          # Сертификат сервера
│   ├── chain.pem         # Цепочка промежуточных сертификатов
│   ├── fullchain.pem     # cert.pem + chain.pem (используйте этот)
│   └── privkey.pem       # Приватный ключ
├── archive/               # Архив старых версий
├── renewal/               # Конфигурация обновления
└── renewal-hooks/        # Скрипты при обновлении

Use fullchain.pem and privkey.pem in your web server configuration.

Testing and verification

After installation, check that:

HTTPS opens — open https://example.com in a browser
The certificate is valid — there are no browser warnings
The redirect works — http://example.com redirects to https://
SSL rating — use SSL Checker for detailed analysis

Additional resources: Complete guide to SSL certificates and Types of SSL certificates.

Conclusion

Let's Encrypt with Certbot lets you obtain and maintain free SSL in just a few minutes. Automatic renewal eliminates routine work. A DV certificate is sufficient for most sites; a wildcard certificate is needed only when you have a large number of subdomains. Follow the steps above, and your site will run over HTTPS at no extra cost.

What is Let's Encrypt

A brief history

Features

Parameter	Value
Cost	Free
Validity period	90 days
Validation type	DV (Domain Validation)
Wildcard	Yes (via DNS challenge)
Certificate limit	50 per domain per week
Duplicate limit	5 per week

ACME protocol

Installing Certbot

Ubuntu / Debian

CodeShell

# Обновление пакетов
sudo apt update

# Установка Certbot и плагина для Nginx или Apache
# Для Nginx:
sudo apt install certbot python3-certbot-nginx -y

# Для Apache:
sudo apt install certbot python3-certbot-apache -y

# Только Certbot (без плагинов, для ручной настройки):
sudo apt install certbot -y

CentOS / RHEL / Rocky Linux

CodeShell

# Установка EPEL (если не установлен)
sudo dnf install epel-release -y

# Certbot для Nginx
sudo dnf install certbot python3-certbot-nginx -y

# Certbot для Apache
sudo dnf install certbot python3-certbot-apache -y

Verify the installation

CodeShell

certbot --version
# certbot 2.x.x

Installing a certificate on Nginx

Automatic mode (recommended)

Certbot can configure Nginx itself: add a location block for the ACME challenge and configure SSL.

CodeShell

# Один домен
sudo certbot --nginx -d example.com

# Несколько доменов (один сертификат)
sudo certbot --nginx -d example.com -d www.example.com

# Интерактивный режим: email для уведомлений, согласие с ToS

Certbot will ask for:

An email address for expiration notifications
Agreement to the terms of service
Optionally, an HTTP → HTTPS redirect (recommended)

Manual Nginx configuration

If you prefer full control, configure Nginx manually and use certbot certonly.

Step 1. Set up a temporary server for the ACME challenge:

CodeNginx

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/html;

    location /.well-known/acme-challenge/ {
        root /var/www/html;
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

Step 2. Create a directory and obtain the certificate:

CodeShell

sudo mkdir -p /var/www/html/.well-known/acme-challenge
sudo chown -R www-data:www-data /var/www/html
sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

Step 3. Add an SSL block to Nginx:

CodeNginx

server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Рекомендуемые настройки SSL (см. раздел ниже)
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/html;
    index index.html;
    # ... остальная конфигурация
}

Step 4. Reload Nginx:

CodeShell

sudo nginx -t
sudo systemctl reload nginx

Full Nginx configuration with SSL

CodeNginx

# Редирект HTTP → HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    location /.well-known/acme-challenge/ {
        root /var/www/html;
    }
    location / {
        return 301 https://$host$request_uri;
    }
}

# HTTPS
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    root /var/www/html;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

Installing a certificate on Apache

Automatic mode

CodeShell

sudo certbot --apache -d example.com -d www.example.com

Certbot will automatically:

Find virtual hosts
Add SSL configuration
Configure a redirect (if you choose one)

Manual Apache configuration

Step 1. Enable the SSL and rewrite modules:

CodeShell

sudo a2enmod ssl rewrite
sudo systemctl restart apache2

Step 2. Obtain the certificate:

CodeShell

sudo certbot certonly --webroot -w /var/www/html -d example.com -d www.example.com

Step 3. Create a virtual host for HTTPS:

CodeApache

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/html

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem
    Include /etc/letsencrypt/options-ssl-apache.conf

    <Directory /var/www/html>
        AllowOverride All
        Require all granted
    </Directory>
</VirtualHost>

Step 4. Redirect HTTP → HTTPS:

CodeApache

<VirtualHost *:80>
    ServerName example.com
    ServerAlias www.example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Step 5. Restart Apache:

CodeShell

sudo apache2ctl configtest
sudo systemctl restart apache2

Wildcard certificates (DNS challenge)

Subdomains such as *.example.com require DNS validation: Let's Encrypt verifies that you control the domain through a TXT record.

Obtaining a wildcard certificate

CodeShell

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

Certbot will display instructions:

CodeText

Please deploy a DNS TXT record under the name _acme-challenge.example.com with the following value:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

Before continuing, verify the record is deployed.

Actions:

Create a TXT record _acme-challenge.example.com with the specified value
Wait for DNS propagation (1–10 minutes; check using dig TXT _acme-challenge.example.com)
Press Enter in Certbot

Automating the DNS challenge

To automatically renew wildcard certificates, use plugins:

certbot-dns-cloudflare — for Cloudflare
certbot-dns-route53 — for AWS Route 53
certbot-dns-google — for Google Cloud DNS

Example for Cloudflare:

CodeShell

sudo apt install python3-certbot-dns-cloudflare -y

Create a file containing the API token:

CodeINI

# /etc/letsencrypt/cloudflare.ini
dns_cloudflare_api_token = YOUR_CLOUDFLARE_API_TOKEN

CodeShell

chmod 600 /etc/letsencrypt/cloudflare.ini
sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini -d example.com -d "*.example.com"

Certificate auto-renewal

Certbot system timer

Certbot creates a systemd timer for automatic renewal. Check its status:

CodeShell

sudo systemctl status certbot.timer
sudo systemctl list-timers | grep certbot

Renewal runs twice a day. Certbot renews certificates 30 days before they expire.

Run renewal manually

CodeShell

# Сухой прогон (без реального обновления)
sudo certbot renew --dry-run

# Реальное обновление
sudo certbot renew

Reload the web server after renewal

By default, Certbot reloads Apache/Nginx after renewal. For custom scripts, use hooks:

CodeShell

# /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
#!/bin/bash
systemctl reload nginx

CodeShell

chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

Cron as a fallback

If systemd is unavailable:

CodeCron

0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

Recommended SSL settings

Modern protocols and ciphers

Certbot creates a file, options-ssl-nginx.conf (or options-ssl-apache.conf), with recommended settings. Key parameters:

Nginx:

CodeNginx

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

Apache:

CodeApache

SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384

HSTS (optional)

Adds the Strict-Transport-Security header to enforce HTTPS in the browser:

Nginx:

CodeNginx

add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

Apache:

CodeApache

Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"

Check security headers using the Security Headers checker.

Common problems and solutions

Error: "Could not find a virtual host"

Certbot could not find a suitable virtual host. Make sure the configuration specifies the correct server_name (Nginx) or ServerName (Apache) for your domain.

Error: "Connection refused" on port 80

Make sure the web server is listening on port 80 and that the firewall is not blocking it:

CodeShell

sudo ss -tlnp | grep :80
sudo ufw status

Error: "DNS problem: NXDOMAIN"

The domain does not resolve. Check the A record:

CodeShell

dig example.com +short

Rate limit exceeded

Let's Encrypt limits issuance to 50 certificates per domain per week and 5 duplicates per week. If you exceed the limit, you must wait. Use --dry-run for testing to avoid using up the limit.

Certificate does not renew

Check the logs:

CodeShell

sudo journalctl -u certbot.timer
sudo certbot renew --dry-run -v

Make sure port 80 is accessible from outside (for the HTTP-01 challenge).

Let's Encrypt file structure

CodeText

/etc/letsencrypt/
├── live/example.com/
│   ├── cert.pem          # Сертификат сервера
│   ├── chain.pem         # Цепочка промежуточных сертификатов
│   ├── fullchain.pem     # cert.pem + chain.pem (используйте этот)
│   └── privkey.pem       # Приватный ключ
├── archive/               # Архив старых версий
├── renewal/               # Конфигурация обновления
└── renewal-hooks/        # Скрипты при обновлении

Use fullchain.pem and privkey.pem in your web server configuration.

Testing and verification

After installation, check that:

HTTPS opens — open https://example.com in a browser
The certificate is valid — there are no browser warnings
The redirect works — http://example.com redirects to https://
SSL rating — use SSL Checker for detailed analysis

Additional resources: Complete guide to SSL certificates and Types of SSL certificates.

What is Let's Encrypt

A brief history

Features

ACME protocol

Installing Certbot

Ubuntu / Debian

CentOS / RHEL / Rocky Linux

Verify the installation

Installing a certificate on Nginx

Automatic mode (recommended)

Manual Nginx configuration

Full Nginx configuration with SSL

Installing a certificate on Apache

Automatic mode

Manual Apache configuration

Wildcard certificates (DNS challenge)

Obtaining a wildcard certificate

Automating the DNS challenge

Certificate auto-renewal

Certbot system timer

Run renewal manually

Reload the web server after renewal

Cron as a fallback

Recommended SSL settings

Modern protocols and ciphers

HSTS (optional)

Common problems and solutions

Error: "Could not find a virtual host"

Error: "Connection refused" on port 80

Error: "DNS problem: NXDOMAIN"

Rate limit exceeded

Certificate does not renew

Let's Encrypt file structure

Testing and verification

Conclusion

Terms by topic

SSL certificate: what it is and why it’s needed

DNS: what it is and how it works

HSTS: what it is and why it is needed

HTTP/2: what it is and why it is needed

HSTS: How to Configure HTTP Strict Transport Security

HTTP security headers: protecting web applications in 2026

Website not opening over HTTPS: step-by-step diagnosis

Check your website

Feedback

What is Let's Encrypt

A brief history

Features

ACME protocol

Installing Certbot

Ubuntu / Debian

CentOS / RHEL / Rocky Linux

Verify the installation

Installing a certificate on Nginx

Automatic mode (recommended)

Manual Nginx configuration

Full Nginx configuration with SSL

Installing a certificate on Apache

Automatic mode

Manual Apache configuration

Wildcard certificates (DNS challenge)

Obtaining a wildcard certificate

Automating the DNS challenge

Certificate auto-renewal

Certbot system timer

Run renewal manually

Reload the web server after renewal

Cron as a fallback

Recommended SSL settings

Modern protocols and ciphers

HSTS (optional)

Common problems and solutions

Error: "Could not find a virtual host"

Error: "Connection refused" on port 80

Error: "DNS problem: NXDOMAIN"

Rate limit exceeded

Certificate does not renew

Let's Encrypt file structure

Testing and verification

Conclusion