Install Free HTTPS with Certbot and Nginx on Ubuntu

Let’s Encrypt provides trusted certificates at no cost. Certbot can configure Nginx, redirect HTTP to HTTPS, and renew the certificate before it expires.

Prerequisites

Before running Certbot, confirm that:

• the domain’s A record points to the VPS;
• every requested hostname resolves to this server;
• Nginx is running and serves the correct HTTP server_name;
• ports 80 and 443 are open in both UFW and the provider firewall;
• no other service blocks the ACME HTTP challenge.

Check DNS and listeners:

dig +short example.com
sudo ss -ltnp | grep -E ':80|:443'

Install Certbot

On Ubuntu, install Certbot and its Nginx plugin:

sudo apt update
sudo apt install -y certbot python3-certbot-nginx

Issue and install the certificate

Request every hostname that should be covered:

sudo certbot --nginx -d example.com -d www.example.com

Choose the HTTP-to-HTTPS redirect when prompted unless another proxy or load balancer owns redirects. Certbot updates the matching Nginx server block and stores the certificate under /etc/letsencrypt/.

Review the result:

sudo nginx -t
sudo systemctl reload nginx
curl -I https://example.com

Test automatic renewal

sudo certbot renew --dry-run
systemctl list-timers | grep certbot

Certificates are short-lived, so renewal testing is part of installation rather than an optional final step.

DNS and challenge errors

NXDOMAIN or the wrong address

Fix the DNS record first. Certbot cannot validate a domain that does not resolve to the server running the challenge.

Connection refused or timeout

Open TCP ports 80 and 443 in UFW and the provider firewall. Confirm Nginx is active and listening on the public interface.

Cloudflare proxy is enabled

Cloudflare can proxy the challenge, but the origin still needs a reachable HTTP configuration. Temporarily switch to DNS-only while isolating DNS and origin issues, then choose a compatible SSL mode.

The wrong Nginx site answers

Check server_name, enabled site symlinks, and the default server. Test the origin directly with a Host header:

curl -I -H 'Host: example.com' http://127.0.0.1
sudo nginx -T

After HTTPS works

Add security headers deliberately, confirm WebSocket and upload settings if required, and verify that the application trusts X-Forwarded-Proto correctly. HTTPS protects the connection in transit; it does not fix vulnerable code, weak passwords, or leaked secrets.

Is a paid certificate required?

No. Let’s Encrypt certificates are trusted and free. Their shorter lifetime is why automated renewal and monitoring matter.