Get Free SSL with Certbot on Nginx VPS Ubuntu Step by Step

Obtaining a free SSL (Secure Sockets Layer) certificate from Let's Encrypt is one of the best decisions you can make for website security. Certbot is the official tool designed to automate the entire process of requesting, installing, and renewing SSL certificates from Let's Encrypt. This comprehensive guide will walk you through every step of installing Certbot on an Ubuntu VPS running Nginx, obtaining your first SSL certificate, and configuring automatic renewal.

Understanding Certbot and Let's Encrypt

Let's Encrypt is a non-profit Certificate Authority that provides free SSL certificates to anyone on the internet. The goal is to make encrypted connections the default everywhere on the web. Certbot is a powerful client software created by the Electronic Frontier Foundation (EFF) that handles all the heavy lifting—requesting certificates, validating domain ownership, installing them on your web server, and automatically renewing before expiration.

• 100% Free — There's no cost whatsoever, and no surprise charges
• Automatic Renewal — Set it once and forget about certificate expiration dates
• Wildcard Support — Obtain Wildcard certificates that cover subdomains like *.example.com
• Browser Trusted — Certificates are recognized by all modern browsers and devices
• Encryption Standard — Provides the same level of security as expensive commercial certificates

Prerequisites Before Getting Started

To ensure a smooth installation process, verify you have all the following requirements met:

• Ubuntu VPS (versions 20.04, 22.04, or 24.04) with root or sudo access
• Nginx web server installed and running on ports 80 and 443
• A registered domain name with DNS A records pointing to your VPS IP address
• Firewall rules allowing inbound traffic on ports 80 (HTTP) and 443 (HTTPS)
• Basic knowledge of SSH, terminal commands, and text editors

Step 1 — Install Certbot and Nginx Plugin

Certbot is available in Ubuntu's standard package repositories. Start by updating your package manager cache, then install Certbot along with the Nginx plugin:

sudo apt-get update
sudo apt-get install -y certbot python3-certbot-nginx

The python3-certbot-nginx package provides Nginx plugin support, which allows Certbot to automatically modify your Nginx configuration files and install SSL certificates in the correct location. Without this plugin, you would need to manually configure Nginx after obtaining certificates.

Step 2 — Prepare and Verify Nginx Configuration

Certbot relies on your Nginx configuration to identify the correct domain names for certificate generation. Before requesting certificates, ensure your Nginx config file contains the proper server_name directives:

sudo nano /etc/nginx/sites-available/default

Your configuration should look like this:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    root /var/www/html;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

After editing, test your Nginx configuration syntax:

sudo nginx -t

The output should show nginx: configuration file test is successful. If you see errors, review your configuration file carefully before proceeding.

Step 3 — Request SSL Certificates from Let's Encrypt

Now you're ready to request your first SSL certificate. Certbot will prove domain ownership by creating a temporary file in your web root that Let's Encrypt servers can verify. Run this command with your actual domain name:

sudo certbot certonly --nginx -d example.com -d www.example.com

Certbot will prompt you to enter an email address and accept the Let's Encrypt terms of service. After validation succeeds, take note of the certificate locations shown in the output. They will typically be:

/etc/letsencrypt/live/example.com/fullchain.pem
/etc/letsencrypt/live/example.com/privkey.pem

These paths are important for configuring Nginx in the next step.

Step 4 — Configure Nginx to Use SSL Certificates

With certificates in place, you need to modify your Nginx configuration to use them. Edit your server configuration file again:

sudo nano /etc/nginx/sites-available/default

Replace the entire server block with this improved version that handles both HTTP and HTTPS traffic:

# Redirect all HTTP traffic to HTTPS
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# Main HTTPS server block
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # SSL certificate paths
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # SSL security settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    root /var/www/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Test the configuration before reloading:

sudo nginx -t

If the test passes, reload Nginx to apply changes:

sudo systemctl reload nginx

Step 5 — Enable and Configure Automatic Renewal

Since Let's Encrypt certificates expire every 90 days, automatic renewal is essential. Ubuntu provides a systemd timer that runs Certbot daily. Enable it with:

sudo systemctl enable certbot.timer
sudo systemctl start certbot.timer

Verify the timer is active:

sudo systemctl status certbot.timer

Test the renewal process without actually renewing (this validates the setup):

sudo certbot renew --dry-run

If you see no errors, your automatic renewal is properly configured. Certbot will now check every day and renew certificates 30 days before expiration.

Step 6 — Verify SSL Installation and Test Functionality

Navigate to your domain in a web browser and look for these indicators of successful SSL installation:

• Green padlock icon or "Secure" label in the address bar
• No warning messages or security alerts from the browser
• HTTP (non-HTTPS) URLs automatically redirect to HTTPS
• No mixed content warnings (all resources load via HTTPS)

For a detailed security assessment, use Qualys SSL Server Test at https://www.ssllabs.com/ssltest/. Enter your domain and wait for the comprehensive report. This tool checks for weak configurations and gives your server a letter grade.

Advanced: Setting Up Wildcard SSL Certificates

If you need SSL coverage for all subdomains (*.example.com), you can request a Wildcard certificate. This requires DNS domain validation instead of HTTP validation:

sudo certbot certonly --manual --preferred-challenges=dns -d example.com -d *.example.com

Certbot will display a DNS TXT record that you need to add to your domain's DNS provider. The process works as follows:

1. Certbot displays the required TXT record name and value
2. Log in to your DNS provider (Cloudflare, Namecheap, GoDaddy, etc.)
3. Add the TXT record to your DNS records
4. Return to Certbot and press Enter to verify
5. Certbot validates domain ownership and issues the Wildcard certificate

The certificate will then cover example.com, *.example.com, and any other subdomain under that main domain.

Troubleshooting Common Problems

Error: "Couldn't connect to renewal server"

This error indicates a connectivity problem. Verify your server has internet access and DNS resolution works:

nslookup example.com
curl -I https://www.google.com

Check firewall rules aren't blocking outbound connections to Let's Encrypt servers.

Error: "Timeout during connect" or "Connection refused"

The domain's DNS A record likely doesn't point to your VPS IP yet. Verify with:

dig example.com

If the IP in the ANSWER section doesn't match your VPS, update DNS at your domain registrar and wait 24-48 hours for propagation.

Port 80 Access Denied

Certbot needs port 80 open for validation challenges. Check if firewall is blocking:

sudo ufw status
sudo iptables -L -n | grep 80

If blocked, allow the ports:

sudo ufw allow 80
sudo ufw allow 443
sudo ufw reload

Certificate Still Expires Despite Auto-Renewal

Check if the renewal timer is actually running:

sudo journalctl -u certbot.timer -n 50

If renewal failed, check the renewal log:

sudo cat /var/log/letsencrypt/letsencrypt.log | tail -50

You can force immediate renewal with:

sudo certbot renew --force-renewal

Summary and Best Practices

Installing SSL certificates with Certbot on Nginx is straightforward and provides enterprise-level encryption at no cost. By following these six steps and setting up automatic renewal, you ensure your website always has valid HTTPS protection. Remember to monitor renewal logs periodically and keep Certbot updated as new security improvements are released. Your website visitors will appreciate the added security and improved trust signals that HTTPS provides.