Let\u2019s Encrypt is a Certificate Authority (CA), developed by the Internet Security Research Group, that provides free and easily obtainable SSL\/TLS certificates. Such certificates are required to enable HTTPS on web servers.<\/p>\n
Let\u2019s Encrypt also provides a very convenient software client, called Certbot, that automates most of the process of obtaining and installing the certificate and is fully automated for Apache<\/strong> and Nginx.<\/strong><\/p>\n In this tutorial we\u2019ll be using Certbot to obtain and install a Let\u2019s Encrypt free certificate for Nginx on Ubuntu 18.04.<\/p>\n\n For this tutorial you\u2019ll need the following:<\/p>\n Certbot development is very active and he Certbot versions found in the Ubuntu default repository tend to be slightly outdated, but the developers also maintain a Ubuntu software repository that has up-to-date versions so we\u2019ll use that repository instead.<\/p>\n First add it:<\/p>\n Press ENTER<\/strong> to accept and add it.<\/p>\n Now update your package index and install the Nginx plugin for Certbot<\/strong>:<\/p>\n Certbot is now ready to use, but before we configure SSL for Nginx, we need to check on Nginx\u2019s current configuration.<\/p>\n Certbot will automatically configure SSL for you, and for that it needs to find the correct If you followed our previous tutorial on how to install Nginx<\/a>, you should have your server block set up for your domain at We can check our server block by opening the serve block file with our favorite text editor:<\/p>\n Here you should be able to see your current If it does look like that, then everything is fine and you can exit the editor. If not, then update it as in the example, and replacing where you see To verify that the syntax in correct in our server block, run:<\/p>\n If you get an error then please check for any typos and run the command again, or leave us a comment and we\u2019ll try to assist as soon as possible.<\/p>\n If everything is OK then we can reload Nginx to load the new configuration:<\/p>\n Now we should be all set and Certbot will be able to find the correct If you\u2019ve followed our prerequisites and have UFW<\/strong> firewall enabled, then we\u2019ll have to change the settings to allow HTTPS traffic.<\/p>\n If you\u2019ve followed the UFW tutorial, then you may remember that applications create Application Profiles<\/strong> for UFW, when they\u2019re installed, and Nginx registers a few application profiles that will make our job easier.<\/p>\n You can check the current UFW settings by running:<\/p>\n The output may look something like this.<\/p>\n From the looks of it, only HTTP (port 80) traffic is allowed to the web server on IPv4 and IPv6, but we need both HTTP and HTTPS (port 80 and port 443).<\/p>\n To allow HTTPS traffic, we’ll allow the Nginx Full<\/strong> profile, which is an easier way of allowing traffic on port 80 and port 443, and delete the Nginx HTTP profile since leaving it would be redundant.<\/p>\n To do this run the following commands:<\/p>\n To make sure, let’s check The output would look something like this:<\/p>\n There are a good number of ways you can obtain SSL certificates using Certbot, by using plugins. The Nginx plugin also takes care of reconfiguring and reloading Nginx whenever necessary. To use the plugin, run the following command:<\/p>\n The command we just used runs If this is the first time you\u2019re running You only need to accept the Licensing Terms to proceed You are not required to share your email, but can do so if you\u2019d like to receive emails regarding their work encrypting the web, EFF news, campaigns, and ways to support digital freedom<\/em>.<\/p>\n Next, you\u2019ll be prompted to answer whether you want to redirect all HTTP traffic to HTTPS. This is an important step!<\/strong><\/p>\n Choose option After that, the Let\u2019s Encrypt Client should install your certificate and configure your website to redirect all traffic to HTTPS.<\/p>\n The certificates are now applied to your website. Go ahead and visit your website and you should notice that you get redirected to You can also test your server usin the SSL Labs Test<\/a>. You should get an A at minimum.<\/p>\n There\u2019s one more thing we need to do and you\u2019ll be all set up.<\/p>\n Everything is all set up, but we want to make sure of one more thing.<\/p>\n Let\u2019s Encrypt certificates expire in 90 days. Normally we\u2019d have to either manually renew or set up an auto-renewal cron job, but We\u2019ll just want to make sure the renewal process goes smoothly. For this we can do a test on it by doing a dry run:<\/p>\n If you don\u2019t get any errors, then everything is all set up correctly. When Cerbot renews your certificates, it will also reload Nginx to apply the changes.<\/p>\n If the renewal process fails, then you\u2019ll be notified via the email you provided at the beginning of the process.<\/p>\n To recap, you\u2019ve successfully installed the Let\u2019s Encrypt client, Certbot, downloaded the FREE SSL Certificates for your domain, configured Nginx to use them and set up automatic certificate renewal. Well done.<\/p>\n If you have any questions, then you can either check the official Certbot documentation<\/a>, or feel free to get in touch with us and will try to help ASAP.<\/p>\n If you\u2019re in the market for a great deal on Linux VPS, then do check out our Linux KVM plans<\/a>. They start at 1GB RAM + 10GB SSD, for only $9.99\/mo.<\/p>\n","protected":false},"excerpt":{"rendered":" Let\u2019s Encrypt is a Certificate Authority (CA), developed by the Internet Security Research Group, that provides free and easily obtainable SSL\/TLS certificates. Such certificates are required to enable HTTPS on web servers. Let\u2019s Encrypt also provides a very convenient software client, called Certbot, that automates most of the process of obtaining and installing the certificate […]<\/p>\n","protected":false},"author":1,"featured_media":1088,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,22],"tags":[52,38,15,51,34],"class_list":["post-1078","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-hosting","category-ubuntu","tag-certbot","tag-lets-encrypt","tag-nginx","tag-ssl","tag-ubuntu"],"blocksy_meta":{"styles_descriptor":{"styles":{"desktop":"","tablet":"","mobile":""},"google_fonts":[],"version":6}},"featured_image_urls_v2":{"full":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04.png",1024,512,false],"thumbnail":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04-150x150.png",150,150,true],"medium":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04-300x150.png",300,150,true],"medium_large":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04-768x384.png",768,384,true],"large":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04.png",1024,512,false],"1536x1536":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04.png",1024,512,false],"2048x2048":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04.png",1024,512,false],"pk-small":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04-80x80.png",80,80,true],"pk-thumbnail":["https:\/\/draculaservers.com\/tutorials\/wp-content\/uploads\/2018\/12\/Using-Let\u2019s-Encrypt-SSL-to-Secure-Nginx-on-Ubuntu-18.04-300x225.png",300,225,true]},"post_excerpt_stackable_v2":" Let\u2019s Encrypt is a Certificate Authority (CA), developed by the Internet Security Research Group, that provides free and easily obtainable SSL\/TLS certificates. Such certificates are required to enable HTTPS on web servers. Let\u2019s Encrypt also provides a very convenient software client, called Certbot, that automates most of the process of obtaining and installing the certificate and is fully automated for Apache and Nginx. In this tutorial we\u2019ll be using Certbot to obtain and install a Let\u2019s Encrypt free certificate for Nginx on Ubuntu 18.04. Prerequisites For this tutorial you\u2019ll need the following: It\u2019s recommended but not necessary to operate as…<\/p>\n","category_list_v2":"Hosting<\/a>, Ubuntu<\/a>","author_info_v2":{"name":"Vlad","url":"https:\/\/draculaservers.com\/tutorials\/author\/vlad\/"},"comments_num_v2":"0 comments","yoast_head":"\nPrerequisites<\/h2>\n
\n
\/etc\/nginx\/sites-available\/dracula.host<\/code>. If you don\u2019t have this set up, you can follow our tutorial on how to install Nginx on Ubuntu 18.04<\/a>, and replace our example domain there, with your domain.<\/li>\ndracula.host<\/code> as our example, and you\u2019ll have to replace it with your own domain when running commands. You can buy domain names at good prices on Namecheap.com<\/a> or free domains at Freenom.com<\/a>, or just use your favorite registrar.<\/li>\n\n
your_domain.com<\/code> pointing at your server\u2019s public IP address<\/li>\nwww.your_domain.com<\/code> pointing at your server\u2019s public IP address<\/li>\n<\/ul>\n<\/li>\n<\/ul>\nStep 1 \u2014 Install Certbot<\/h2>\n
$ sudo add-apt-repository ppa:certbot\/certbot <\/code><\/pre>\n$ sudo apt install python-certbot-nginx<\/code><\/pre>\nStep 2 \u2014 Verify Nginx Configuration<\/h2>\n
server<\/code> block in your nginx configuration. It does this by checking the server_name<\/code> directive that matches the domain you\u2019re requesting the server for.<\/p>\n\/etc\/nginx\/sites-available\/your_site.com<\/code> with the server_name<\/code> directive set.<\/p>\n$ sudo nano \/etc\/nginx\/sites-available\/your_site.com<\/code><\/pre>\nserver_name<\/code> directive, and it should look like this:<\/p>\n...\r\nserver_name you_site.com www.your_site.com\r\n...<\/code><\/pre>\nyour_site.com<\/code> with your domain.<\/p>\n$ sudo nginx -t<\/code><\/pre>\n$ sudo systemctl reload nginx<\/code><\/pre>\nserver<\/code> block.<\/p>\nStep 3 \u2014 Allow HTTPS through UFW Firewall<\/h2>\n
$ sudo ufw status<\/code><\/pre>\nOutput\r\nStatus: active\r\n\r\nTo Action From\r\n-- ------ ----\r\nOpenSSH ALLOW Anywhere \r\nNginx HTTP ALLOW Anywhere \r\nOpenSSH (v6) ALLOW Anywhere (v6) \r\nNginx HTTP (v6) ALLOW Anywhere (v6)<\/code><\/pre>\n$ sudo ufw allow 'Nginx Full'\r\n$ sudo ufw delete allow 'Nginx HTTP'<\/code><\/pre>\nufw status<\/code> again:<\/p>\n$ sudo ufw status<\/code><\/pre>\nStatus: active\r\n\r\nTo Action From\r\n-- ------ ----\r\nOpenSSH ALLOW Anywhere\r\nNginx Full ALLOW Anywhere\r\nOpenSSH (v6) ALLOW Anywhere (v6)\r\nNginx Full (v6) ALLOW Anywhere (v6)<\/code><\/pre>\nStep 4 \u2014 Obtain Free SSL Certificates<\/h2>\n
$ sudo certbot --nginx -d your_site.com -d www.your_site.com<\/code><\/pre>\ncertbot<\/code> with the --nginx<\/code> plugin. We used -d<\/code> to specify the domains for which we\u2019re requesting the certificate.<\/p>\ncetbot<\/code> on this machine, then you\u2019ll be prompted to enter your email address and if you accept the Licensing Terms and after that, if you would like to share your email to receive news from the Electronic Frontier Foundation which is an organization that works towards digital freedom ( In short, they\u2019re trustworthy, don\u2019t spam, and are fighting the good fight, in our opinion ).<\/p>\n(A)<\/code>.<\/p>\nPlease read the Terms of Service at\r\nhttps:\/\/letsencrypt.org\/documents\/LE-SA-v1.2-November-15-2017.pdf. You must\r\nagree in order to register with the ACME server at\r\nhttps:\/\/acme-v02.api.letsencrypt.org\/directory\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n(A)gree\/(C)ancel: A<\/code><\/pre>\nWould you be willing to share your email address with the Electronic Frontier\r\nFoundation, a founding partner of the Let's Encrypt project and the non-profit\r\norganization that develops Certbot? We'd like to send you email about our work\r\nencrypting the web, EFF news, campaigns, and ways to support digital freedom.\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n(Y)es\/(N)o: Y<\/code><\/pre>\n2<\/code>, so everyone visiting, for example, http:\/\/dracula.host<\/code> will be actually be redirected to https:\/\/dracula.host<\/code><\/p>\nPlease choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n1: No redirect - Make no further changes to the webserver configuration.\r\n2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for new sites, or if you're confident your site works on HTTPS. You can undo this change by editing your web server's configuration.\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\nSelect the appropriate number [1-2] then [enter] (press 'c' to cancel): 2<\/code><\/pre>\nCongratulations! You have successfully enabled https:\/\/dracula.host and\r\nhttps:\/\/www.dracula.host\r\n\r\nYou should test your configuration at:\r\nhttps:\/\/www.ssllabs.com\/ssltest\/analyze.html?d=dracula.host\r\nhttps:\/\/www.ssllabs.com\/ssltest\/analyze.html?d=www.dracula.host\r\n- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -\r\n\r\nIMPORTANT NOTES:\r\n - Congratulations! Your certificate and chain have been saved at:\r\n \/etc\/letsencrypt\/live\/dracula.host\/fullchain.pem \r\n Your key file has been saved at: \r\n \/etc\/letsencrypt\/live\/dracula.host\/privkey.pem \r\n Your cert will expire on 2019-01-21. To obtain a new or tweaked \r\n version of this certificate in the future, simply run certbot again \r\n with the \"certonly\" option. To non-interactively renew *all* of \r\n your certificates, run \"certbot renew\" \r\n - Your account credentials have been saved in your Certbot \r\n configuration directory at \/etc\/letsencrypt. You should make a \r\n secure backup of this folder now. This configuration directory will \r\n also contain certificates and private keys obtained by Certbot so \r\n making regular backups of this folder is ideal. \r\n - If you like Certbot, please consider supporting our work by: \r\n\r\n Donating to ISRG \/ Let's Encrypt: https:\/\/letsencrypt.org\/donate \r\n Donating to EFF: https:\/\/eff.org\/donate-le<\/code><\/pre>\nhttps:\/\/your_site.com<\/code> and the browser indicates that your sites is secure.<\/p>\nStep 5 \u2014 Checking SSL Certificate Auto-Renewal<\/h2>\n
certbot<\/code> took care of this for us, but adding the renew script in \/etc\/cron.d<\/code>. This script will run twice a day, and will renew any certificate that\u2019s within 30 days of expiring.<\/p>\n$ sudo certbot renew --dry-run<\/code><\/pre>\nConclusion<\/h2>\n