Let's Encrypt issues free, browser-trusted TLS certificates to anyone who can prove they control a domain. Certbot, from the EFF, is the usual client on a Linux server: it proves control, fetches the certificate, configures nginx or Apache and renews it before it expires.
This guide covers a single server with a public IP address and ports 80 and 443 open. For Windows and IIS, see Let's Encrypt on Windows and IIS.
Before you start
- DNS points at the server.
dig +short A example.commust return this server's address, for every name you want on the certificate (example.comandwww.example.comare two names). - Port 80 is reachable from the internet. Let's Encrypt's default check,
HTTP-01, fetches a file from
http://<name>/.well-known/acme-challenge/. A firewall that only allows 443 makes it fail. - nginx or Apache already serves the site on port 80 with a
server_name(nginx) orServerName(Apache) matching each name.
Step 1: install Certbot
The EFF recommends the snap package, which keeps Certbot up to date:
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
Your distribution's own package also works if you'd rather avoid snap.
Remove any old certbot-auto or apt copy first so only one Certbot runs.
Step 2: get the certificate
For nginx:
sudo certbot --nginx -d example.com -d www.example.com
For Apache:
sudo certbot --apache -d example.com -d www.example.com
Certbot asks for an email address and for you to accept the terms, proves
control of each name, installs the certificate and adds the HTTPS settings to
your server's configuration. If you only want the files and will configure
the server yourself, use certonly instead:
sudo certbot certonly --nginx -d example.com
The files land in /etc/letsencrypt/live/example.com/:
| File | What it is |
|---|---|
fullchain.pem |
your certificate plus the intermediate: what the server sends |
privkey.pem |
the private key: never share it |
Point your server at fullchain.pem, not cert.pem. A server that sends
only its own certificate works in some browsers and fails in others and in
API clients, because they can't build the chain.
Step 3: check renewal works
Certbot installs a timer that tries to renew twice a day and renews when a certificate is close to expiry. Test it once now:
sudo certbot renew --dry-run
systemctl list-timers | grep certbot
Recent Certbot versions (4.1 and later) also ask Let's Encrypt when to renew (ACME Renewal Information), so a certificate that has to be replaced early is replaced automatically.
After renewal, the server must load the new file. --nginx and
--apache reload the server for you. With certonly, add a deploy hook:
sudo certbot renew --deploy-hook "systemctl reload nginx"
A certificate renewed on disk but never loaded is the most common way a "working" setup expires anyway. See certificate renewed but not installed.
Wildcards need DNS validation
*.example.com can only be validated with DNS-01: Certbot creates a TXT
record at _acme-challenge.example.com. Do it with a DNS plugin for your
provider (Cloudflare, Route 53 and others have one) so renewals stay
automatic. A wildcard obtained with --manual won't renew on its own.
Rate limits worth knowing
Let's Encrypt limits how many certificates you can get, mostly to stop broken scripts:
- 50 new certificates per registered domain every 7 days;
- 5 duplicate certificates (the exact same names) every 7 days;
- 5 failed validations per name, per account, per hour.
Test changes with --dry-run (or --staging) first; failed attempts against
the real service count.
What's changing
- No more expiry emails. Let's Encrypt stopped sending expiration reminders on 4 June 2025. Nothing tells you a renewal failed except your own monitoring.
- No more OCSP. Revocation is published only through CRLs since August 2025. Nothing to change on a normal web server.
- Shorter certificates. Certificates last 90 days today. Let's Encrypt plans 64 days from 10 February 2027 and 45 days from 16 February 2028, following the industry move described in 47-day SSL certificates. Automated renewal with Certbot keeps working; anything renewed by hand won't.
Check your domain
The SSL expiry checker shows the certificate every hostname actually serves and when it expires, and spots a certificate that was renewed but never installed. Nameward's monitoring alerts you before any of them lapse.