Free HTTPS certificate on a VPS with certbot

Let’s Encrypt issues TLS certificates at no cost, valid for 90 days. Certbot automates the request and the renewal. Two conditions: the domain must already point to your VPS, and ports 80 and 443 must be reachable from the Internet.

• Let’s Encrypt issues free certificates valid for 90 days, which certbot renews on its own.
• The domain must already point to the VPS, and ports 80 and 443 must be open.
• Run a renewal test with --dry-run right after the installation.

Prepare the server

Certbot needs a name that resolves to the VPS (see the article on A records) and a web server listening on port 80. On Debian or Ubuntu, install Nginx and certbot with its plugin.

• sudo apt update && sudo apt install -y nginx certbot python3-certbot-nginx
• sudo ufw allow 'Nginx Full' if the UFW firewall is active (otherwise, skip this line).
• Check that the site answers over HTTP before you continue: curl -I http://example.com.

Request the certificate

One command configures Nginx and downloads the certificate. Certbot then offers to redirect HTTP to HTTPS: accept, unless you have a specific reason not to.

• sudo certbot --nginx -d example.com -d www.example.com
• The files are in /etc/letsencrypt/live/example.com/: fullchain.pem and privkey.pem.
• Test the configuration, then reload: sudo nginx -t && sudo systemctl reload nginx.

Check the renewal

A certificate expires after 90 days. Debian and Ubuntu packages install a systemd timer that tries to renew twice a day. You only need to check that it works.

• systemctl list-timers | grep certbot: the timer must show its next run.
• sudo certbot renew --dry-run: simulates a renewal without changing the certificates.
• sudo certbot certificates: shows the expiry date of each certificate.