How To Secure Nginx With a Free SSL Certificate Using Let's Encrypt (Certbot)
Goal
In this tutorial, you will install Certbot, obtain a free Let's Encrypt TLS certificate for an Nginx site, enable an automatic HTTP-to-HTTPS redirect, and verify that certificate renewal is configured to happen automatically.
Prerequisites
- A server/VPS running Ubuntu 22.04 or 24.04 with a non-root user that has sudo privileges
- Nginx installed and already serving a site (see the previous tutorial in this series)
- A registered domain name (e.g. example.com) with an A record already pointing at this server's public IP
- UFW firewall enabled with HTTP and HTTPS traffic allowed, e.g. via sudo ufw allow 'Nginx Full'
Let an AI agent do this for you
Copy a ready-made prompt for an AI coding assistant with terminal access to your server (Claude Code, Cursor, or similar) — it can carry out the steps below for you. Review what it plans to run before it executes anything.
Let's Encrypt issues free, browser-trusted TLS certificates and Certbot automates both obtaining them and configuring your web server to use them. This tutorial walks through installing Certbot's Nginx plugin, issuing a certificate for a domain already served by Nginx, confirming the HTTP-to-HTTPS redirect, and verifying that renewal happens automatically before the certificate expires.
Step 1 — Install Certbot and the Nginx plugin
Ubuntu 22.04 and 24.04 ship a current enough version of Certbot in the default repositories, and installing via apt is the officially recommended method on these releases — you don't need a third-party PPA or the certbot-auto script. python3-certbot-nginx is the plugin that lets Certbot read and edit your Nginx configuration directly, instead of you having to paste certificate paths in by hand.
sudo apt update
sudo apt install -y certbot python3-certbot-nginxStep 2 — Confirm DNS and the firewall are ready
Let's Encrypt validates domain ownership using the HTTP-01 challenge: it makes an HTTP request to your domain on port 80 and expects your server to answer with a specific token. That only works if the domain's DNS A record already resolves to this server's public IP, and if port 80 is actually reachable from the internet.
“Do not run certbot until DNS has propagated. If example.com does not yet resolve to this server's IP, the HTTP-01 challenge will fail every time, regardless of how your firewall or Nginx is configured.”
If you just created or changed the domain's A record, give it time before proceeding — propagation can take anywhere from a few minutes to a few hours depending on your registrar and the record's TTL. Confirm with your DNS provider or registrar that the record is already live and pointing at this server before moving on.
Next confirm the firewall allows inbound HTTP and HTTPS. If you followed the earlier Nginx setup tutorial, this should already be in place:
sudo ufw statusYou should see Nginx Full (or ports 80 and 443 individually) listed as ALLOW. If it isn't there, add it — never leave the firewall disabled entirely just to get past this step:
sudo ufw allow 'Nginx Full'Step 3 — Obtain and install the certificate
Run Certbot with the Nginx plugin, listing every hostname the certificate should cover:
Tricknowtech Domain Registration
50+ TLDs with free WHOIS privacy protection and free DNS management on every domain.
Ready to try it yourself?
Create a free account and follow along.