{"id":1371,"date":"2026-09-03T11:37:42","date_gmt":"2026-09-03T06:07:42","guid":{"rendered":"https:\/\/cpanelfree.com\/blog\/how-to-install-lets-encrypt-ssl-certbot-linux\/"},"modified":"2026-09-03T12:32:31","modified_gmt":"2026-09-03T07:02:31","slug":"how-to-install-lets-encrypt-ssl-certbot-linux","status":"publish","type":"post","link":"https:\/\/cpanelfree.com\/blog\/how-to-install-lets-encrypt-ssl-certbot-linux\/","title":{"rendered":"How to Install Free Let’s Encrypt SSL on Linux (Certbot Auto-Renewal Guide)"},"content":{"rendered":"
\n

\n Quick Answer:<\/strong> To install a free Let’s Encrypt SSL certificate on a Linux VPS, install Certbot via snap (sudo snap install --classic certbot<\/code>), run the web server plugin (sudo certbot --nginx<\/code> or sudo certbot --apache<\/code>), enter your domain and email, and verify automated renewal with sudo certbot renew --dry-run<\/code>.\n <\/p>\n<\/div>\n

Why SSL\/TLS Encryption is Non-Negotiable in 2026<\/h2>\n

HTTPS encryption is a baseline requirement for modern websites. Web browsers flag unencrypted HTTP sites as “Not Secure,” destroying user trust and conversion rates. Furthermore, Google uses HTTPS as a core ranking signal, and modern web protocols like HTTP\/2 and HTTP\/3 require TLS encryption by specification.<\/p>\n

Let’s Encrypt<\/strong> provides free, domain-validated X.509 certificates trusted by all major root certificate authorities and web browsers worldwide.<\/p>\n

Step 1: Installing Certbot via Snap on Ubuntu 24.04<\/h2>\n

The Electronic Frontier Foundation (EFF) officially recommends installing Certbot via Snap to ensure you always receive the latest ACME protocol updates and cryptographic cipher suites:<\/p>\n

# Ensure snap core is up to date\nsudo snap install core; sudo snap refresh core\n\n# Install Certbot with classic confinement\nsudo snap install --classic certbot\n\n# Create symlink to standard binary path\nsudo ln -s \/snap\/bin\/certbot \/usr\/bin\/certbot<\/pre>\n
Step 2: Automated 1-Command SSL Deployment<\/h2>\n
Ensure your domain’s DNS A records (e.g. yourdomain.com<\/code> and www.yourdomain.com<\/code>) are pointing directly to your VPS IP address. Then execute the automated installer for your web server stack:<\/p>\n
For Nginx Servers:<\/h3>\n
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com<\/pre>\n
For Apache Servers:<\/h3>\n
sudo certbot --apache -d yourdomain.com -d www.yourdomain.com<\/pre>\n
Certbot communicates with the Let’s Encrypt ACME server, verifies domain ownership via HTTP-01 challenge, generates a 2048-bit RSA or ECDSA key pair, downloads the signed certificate chain, and automatically edits your virtual host configuration to enable HTTPS and HTTP-to-HTTPS 301 redirection.<\/p>\n
Step 3: Verifying Automated Renewal Cron \/ Systemd Timer<\/h2>\n
Let’s Encrypt certificates are valid for 90 days. Certbot installs a systemd timer that runs twice daily and automatically renews any certificate within 30 days of expiration:<\/p>\n
# Test simulated renewal process\nsudo certbot renew --dry-run\n\n# Inspect active systemd renewal timer\nsystemctl list-timers | grep certbot<\/pre>\n
Hardening TLS Security: Enabling HSTS & Modern Cipher Suites<\/h2>\n
After issuing your Let’s Encrypt certificate, maximize your SSL security rating by enforcing HTTP Strict Transport Security (HSTS)<\/strong> and disabling obsolete TLS 1.0 and TLS 1.1 protocols. Edit your Nginx virtual host:<\/p>\n
# Enforce modern TLS 1.2 and TLS 1.3 only\nssl_protocols TLSv1.2 TLSv1.3;\nssl_prefer_server_ciphers off;\nssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384;\n\n# Enable HSTS (1 Year duration with subdomains)\nadd_header Strict-Transport-Security \"max-age=31536000; includeSubDomains; preload\" always;\nadd_header X-Content-Type-Options nosniff;\nadd_header X-Frame-Options SAMEORIGIN;<\/pre>\n
Setting Up Automated Certbot Post-Renewal Hooks<\/h2>\n
When Certbot automatically renews a certificate, your web server must reload its memory cache to serve the new certificate chain without downtime. Configure a deploy hook in \/etc\/letsencrypt\/renewal-hooks\/deploy\/reload-webserver.sh<\/code>:<\/p>\n
#!\/bin\/bash\nsystemctl reload nginx || systemctl reload apache2<\/pre>\n
Make the script executable with sudo chmod +x \/etc\/letsencrypt\/renewal-hooks\/deploy\/reload-webserver.sh<\/code>.<\/p>\n
Troubleshooting Certbot SSL Verification Failures (HTTP-01 & DNS-01)<\/h2>\n
If Certbot returns error codes during domain verification, follow these diagnostic steps to resolve the root cause:<\/p>\n