2.6 KiB
2.6 KiB
🔐 Certbot
📦 Install Certbot
sudo apt update
sudo apt install certbot python3-certbot-nginx -y
Installs Certbot and the Nginx plugin to automatically manage certificates.
🖥️ Method 1 – Standalone Mode
sudo certbot certonly --standalone -d www.example.com
💡 Standalone mode runs its own temporary server for domain verification.
-
Use if Nginx is not running on port 80/443.
-
Certificates saved in:
/etc/letsencrypt/live/<domain>/→ latest version (symlink)/etc/letsencrypt/archive/<domain>/→ all versions
🌐 Method 2 – Webroot Mode
sudo certbot certonly --webroot -w /var/www/html -d www.example.com
💡 Webroot mode places verification files in your website’s public folder.
<path>= Nginx document root- Use if Nginx is running and serving your site.
🛠️ Method 3 – Nginx Plugin (Auto Configuration)
sudo certbot --nginx -d www.example.com -d example.com
💡 Nginx plugin automatically:
- Obtains SSL certificate
- Configures HTTPS in Nginx
- Adds HTTP → HTTPS redirect
- Reloads Nginx
🌱 Method 4 – Manual DNS Challenge (Wildcard)
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com
💡 DNS challenge is required for wildcard certificates or if HTTP verification isn’t possible.
- Add TXT record as instructed by Certbot
- Works even if Nginx is down or port 80 is blocked
♻️ Renew Certificates
Automatic Renewal
sudo certbot renew
- Renews all certificates nearing expiration
Force Renewal
sudo certbot renew --force-renewal
- Immediately renews certificates, even if not near expiry
Test Renewal
sudo certbot renew --dry-run
- Tests renewal without making changes
🔄 Reload Nginx After Renewal
sudo systemctl reload nginx
- Apply new certificates without downtime
Tip: You can add a deploy-hook for automatic reload:
sudo certbot renew --deploy-hook "systemctl reload nginx"
📅 Tips & Best Practices
- Certificates expire every 90 days — enable auto-renewal.
- Keep
/etc/letsencrypt/backed up (contains keys and configs). - Use staging for testing to avoid hitting rate limits:
sudo certbot --staging --nginx -d www.example.com
- Monitor renewal logs:
/var/log/letsencrypt/letsencrypt.log
✨ Result: Fully automated HTTPS for Nginx with Let’s Encrypt certificates. Fast, free, and secure! 🔒🚀