How to Install Free Let’s Encrypt SSL on Linux (Certbot Auto-Renewal Guide)

Why SSL/TLS Encryption is Non-Negotiable in 2026

HTTPS encryption is a baseline requirement for modern websites. Web browsers flag unencrypted HTTP sites as “Not Secure,” destroying user trust and conversion rates. Furthermore, Google uses HTTPS as a core ranking signal, and modern web protocols like HTTP/2 and HTTP/3 require TLS encryption by specification.

Let’s Encrypt provides free, domain-validated X.509 certificates trusted by all major root certificate authorities and web browsers worldwide.

Step 1: Installing Certbot via Snap on Ubuntu 24.04

The Electronic Frontier Foundation (EFF) officially recommends installing Certbot via Snap to ensure you always receive the latest ACME protocol updates and cryptographic cipher suites:

# Ensure snap core is up to date
sudo snap install core; sudo snap refresh core

# Install Certbot with classic confinement
sudo snap install --classic certbot

# Create symlink to standard binary path
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Step 2: Automated 1-Command SSL Deployment

Ensure your domain’s DNS A records (e.g. yourdomain.com and www.yourdomain.com) are pointing directly to your VPS IP address. Then execute the automated installer for your web server stack:

For Nginx Servers:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache Servers:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot communicates with the Let’s Encrypt ACME server, verifies domain ownership via HTTP-01 challenge, generates a 2048-bit RSA or ECDSA key pair, downloads the signed certificate chain, and automatically edits your virtual host configuration to enable HTTPS and HTTP-to-HTTPS 301 redirection.

Step 3: Verifying Automated Renewal Cron / Systemd Timer

Let’s Encrypt certificates are valid for 90 days. Certbot installs a systemd timer that runs twice daily and automatically renews any certificate within 30 days of expiration:

# Test simulated renewal process
sudo certbot renew --dry-run

# Inspect active systemd renewal timer
systemctl list-timers | grep certbot

Hardening TLS Security: Enabling HSTS & Modern Cipher Suites

After issuing your Let’s Encrypt certificate, maximize your SSL security rating by enforcing HTTP Strict Transport Security (HSTS) and disabling obsolete TLS 1.0 and TLS 1.1 protocols. Edit your Nginx virtual host:

# Enforce modern TLS 1.2 and TLS 1.3 only
ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;

# Enable HSTS (1 Year duration with subdomains)
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
add_header X-Content-Type-Options nosniff;
add_header X-Frame-Options SAMEORIGIN;

Setting Up Automated Certbot Post-Renewal Hooks

When Certbot automatically renews a certificate, your web server must reload its memory cache to serve the new certificate chain without downtime. Configure a deploy hook in /etc/letsencrypt/renewal-hooks/deploy/reload-webserver.sh:

#!/bin/bash
systemctl reload nginx || systemctl reload apache2

Make the script executable with sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-webserver.sh.

Troubleshooting Certbot SSL Verification Failures (HTTP-01 & DNS-01)

If Certbot returns error codes during domain verification, follow these diagnostic steps to resolve the root cause:

• CAA Record Restricting Let’s Encrypt: If your domain DNS includes CAA (Certification Authority Authorization) records that only permit DigiCert or Sectigo, Certbot will be blocked. Add issue "letsencrypt.org" to your DNS CAA records.
• Cloudflare Flexible SSL Redirect Loop: If using Cloudflare proxy with “Flexible SSL” mode, Nginx will receive HTTP requests while forcing HTTPS redirects, creating an infinite ERR_TOO_MANY_REDIRECTS loop. Change your Cloudflare SSL encryption mode to Full (Strict).
• Firewall Dropping HTTP Port 80: Let’s Encrypt HTTP-01 challenges MUST connect to port 80 over plain HTTP to verify domain ownership before issuing the TLS certificate. Ensure port 80 is open in UFW during the issuance process.
• IPv6 (AAAA Record) Misconfiguration: If your domain has an AAAA record pointing to an obsolete or inactive IPv6 address, Let’s Encrypt ACME servers will attempt IPv6 validation first and fail. Update or remove inactive AAAA records.

Configuring OCSP Stapling for Ultra-Fast HTTPS Handshakes

OCSP Stapling speeds up TLS connection establishment by having your web server cache the certificate revocation status directly from Let’s Encrypt, eliminating client-side DNS lookups to certificate authority servers during the browser handshake:

# Enable OCSP Stapling in Nginx
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/letsencrypt/live/yourdomain.com/chain.pem;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

Multi-Domain & Subject Alternative Name (SAN) SSL Certificates

If your VPS hosts multiple domains or staging subdomains, Certbot allows you to combine up to 100 domain names into a single unified Subject Alternative Name (SAN) certificate. This streamlines TLS management and simplifies virtual host configurations:

# Issue a single SAN multi-domain certificate
sudo certbot --nginx -d example.com -d www.example.com -d app.example.com -d api.example.com

Setting Up Automated Failure Alert Notifications for SSL Renewal

Although Certbot renews certificates automatically, unexpected DNS propagation failures or firewall rule resets could prevent renewal. Create a monitoring script that alerts your engineering team if any certificate has less than 15 days of validity remaining:

#!/bin/bash
EXPIRY_DAYS=$(certbot certificates | grep 'VALID:' | awk '{print $2}' | head -n 1)
if [ "$EXPIRY_DAYS" -lt 15 ]; then
    echo "Warning: SSL Certificate expiring in ${EXPIRY_DAYS} days!" | mail -s "SSL Expiry Alert" [email protected]
fi

Frequently Asked Questions