Enable HTTPS with free TLS certificates

HTTPS encrypts traffic between your visitors and your server, and browsers expect it everywhere. Certbot is an open-source client that obtains free certificates from a free, automated certificate authority, installs them into nginx or Apache, and renews them automatically.

Before you begin

A working website on nginx or Apache, with server_name or ServerName set to your domain.
DNS A records for example.com and www.example.com that point to your server's IP address, 203.0.113.10.
Ports 80 and 443 open in the firewall, and a sudo user such as deploy.

Step 1: Confirm DNS first

The certificate authority checks that your domain really points to your server, and that check happens over the public internet. If DNS is wrong, the request will fail. Verify both names before you continue:

dig +short example.com A
dig +short www.example.com A

203.0.113.10
203.0.113.10

Step 2: Install Certbot

Install Certbot and the plugin for your web server. Use the nginx plugin if you run nginx, or the apache plugin if you run Apache.

sudo apt update
sudo apt install -y certbot python3-certbot-nginx

For Apache, install python3-certbot-apache instead.

Step 3: Open the HTTPS port

Certificate validation uses port 80, and visitors use port 443 for HTTPS. Allow both. For nginx use the Nginx Full profile. For Apache use Apache Full.

sudo ufw allow 'Nginx Full'
sudo ufw status

Step 4: Request a certificate

The -d flag names each domain the certificate should cover. Include both the bare name and the www name. Certbot asks for an email address for expiry notices, asks you to accept the terms of service, and asks whether to redirect HTTP to HTTPS. Choose the redirect option.

sudo certbot --nginx -d example.com -d www.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/example.com/privkey.pem
Successfully deployed certificate for example.com to /etc/nginx/sites-enabled/example.com

For Apache, use sudo certbot --apache -d example.com -d www.example.com instead.

Tip: While you are experimenting, add --test-cert to the command. It uses a staging certificate that browsers do not trust, but it avoids the strict limits on real issuance.

Step 5: Test HTTPS

Request the headers over HTTPS. A status of 200 means the page loads over a secure connection.

curl -I https://example.com

HTTP/2 200
server: nginx

Open the site in a browser and check for the padlock icon in the address bar.

Step 6: Confirm automatic renewal

Certificates from this authority last 90 days. The Ubuntu Certbot package installs a systemd timer that checks for renewal twice a day and renews certificates that are close to expiry. You do not need to schedule anything yourself. Confirm the timer exists, then run a renewal test that changes nothing:

systemctl list-timers | grep certbot
sudo certbot renew --dry-run

Congratulations, all simulated renewals succeeded:
  /etc/letsencrypt/live/example.com/fullchain.pem (success)

Troubleshooting

"Timeout during connect" errors. Port 80 is blocked or the IP address is wrong. Check sudo ufw status and confirm your DNS records point to the server.
"NXDOMAIN" or "no valid A records" errors. A name in your command has no DNS record yet. Create it in Lantern DNS, wait a few minutes, and check with dig.
Rate limit errors. You have requested too many certificates for the same names in a short time. Wait, and use --test-cert while you test.
The renewal dry run fails. The output names the failing domain and reason. Fix it first, then run the dry run again. Keep port 80 open so renewals can complete.

Next steps

Once HTTPS works, make sure every visitor lands on the secure address by following Redirect HTTP to HTTPS and www to non-www. You can also speed up delivery with Enable compression and browser caching.