Free SSL Certificates and HTTPS: Issuing and Auto-Renewing with Let's Encrypt

HTTPS is table stakes for any website today. It encrypts traffic between the browser and your server, stops eavesdropping and tampering, and keeps browsers from flagging your site as "Not secure." Certificates used to cost money, but Let's Encrypt now issues them for free and fully automated. Paired with the official certbot tool, a handful of commands covers issuance, installation, and renewal. This guide walks through the full flow using Nginx.

Before you start

Make sure you have:

• A server you can SSH into (a VPS or dedicated host) with root or sudo access.
• Your domain's A/AAAA records pointing at the server's public IP.
• Ports 80 and 443 open to the internet (in both the firewall and any cloud security group).
• Your site already serving HTTP through Nginx.

Let's Encrypt verifies ownership by hitting http://your-domain/.well-known/, so the domain must genuinely resolve to this server.

Install certbot

Installing via snap is recommended: you get a recent version with the renewal timer built in.

Ubuntu / Debian:

sudo apt update
sudo apt install -y snapd
sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/bin/certbot

CentOS / Rocky:

sudo dnf install -y epel-release
sudo dnf install -y certbot python3-certbot-nginx

If you'd rather skip snap, Ubuntu/Debian can also just run sudo apt install -y certbot python3-certbot-nginx.

Issue and install the certificate in one shot

The easiest path is to let certbot edit your Nginx config for you:

sudo certbot --nginx -d example.com -d www.example.com

On the first run it asks for an email (used for renewal reminders) and asks you to accept the terms. certbot then handles domain validation, downloads the certificate, and writes the sslcertificate directives into the matching Nginx server block.

It will also offer to redirect HTTP traffic to HTTPS. Pick Redirect to turn on forced HTTPS automatically. Once it finishes, visit https://example.com and you should see a valid padlock in the browser.

By default the files live under /etc/letsencrypt/live/example.com/, where fullchain.pem is the certificate chain and privkey.pem is the private key.

Forcing HTTPS by hand

If you'd rather control the redirect yourself, add this to the port 80 server block in Nginx:

server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$host$request_uri;
}

Then apply it with sudo nginx -t && sudo systemctl reload nginx.

Automatic renewal

Let's Encrypt certificates are valid for only 90 days, so renewal is not optional. The good news: certbot already installed a scheduled job for you.

Test the renewal flow first with a dry run, which changes nothing:

sudo certbot renew --dry-run

A Congratulations message means you're set. A real renewal is simply:

sudo certbot renew

It only renews certificates within 30 days of expiry and reloads Nginx automatically.

The job runs on a systemd timer. Confirm it's active:

systemctl list-timers | grep certbot
systemctl status snap.certbot.renew.timer

The apt-installed version uses certbot.timer instead. With the timer in place, you never have to touch renewals by hand—certificates refresh before they expire.

Wildcard certificates (in brief)

To cover a wildcard like .example.com, HTTP validation isn't enough; you need DNS validation, where you add a TXT record certbot specifies to prove you control the domain:

sudo certbot certonly --manual --preferred-challenges dns \
  -d example.com -d '*.example.com'

certbot prints a TXT value; add it in your DNS provider's dashboard, wait for it to propagate, then press Enter to continue. If your DNS provider has a certbot plugin (Cloudflare, for example), you can automate issuance and renewal entirely and skip the manual record edits.

Summary

With Let's Encrypt and certbot, free HTTPS comes down to three steps: install certbot, run certbot --nginx to issue the cert and enable the redirect, then lean on the systemd timer for renewals. Remember that certificates expire every 90 days—validate the renewal path with --dry-run, get the forced redirect in place, and your site will stay on HTTPS for the long haul. For wildcard certificates, switch to DNS validation.