# Get a free SSL certificate from Let's Encrypt with Certbot

Let's Encrypt issues free, browser-trusted TLS certificates to anyone who can
prove they control a domain. Certbot, from the EFF, is the usual client on a
Linux server: it proves control, fetches the certificate, configures nginx or
Apache and renews it before it expires.

This guide covers a single server with a public IP address and ports 80 and
443 open. For Windows and IIS, see
[Let's Encrypt on Windows and IIS](/guides/lets-encrypt-iis-win-acme).

## Before you start

- **DNS points at the server.** `dig +short A example.com` must return this
  server's address, for every name you want on the certificate
  (`example.com` and `www.example.com` are two names).
- **Port 80 is reachable from the internet.** Let's Encrypt's default check,
  HTTP-01, fetches a file from `http://<name>/.well-known/acme-challenge/`.
  A firewall that only allows 443 makes it fail.
- **nginx or Apache already serves the site** on port 80 with a
  `server_name` (nginx) or `ServerName` (Apache) matching each name.

## Step 1: install Certbot

The EFF recommends the snap package, which keeps Certbot up to date:

```
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot
```

Your distribution's own package also works if you'd rather avoid snap.
Remove any old `certbot-auto` or apt copy first so only one Certbot runs.

## Step 2: get the certificate

For nginx:

```
sudo certbot --nginx -d example.com -d www.example.com
```

For Apache:

```
sudo certbot --apache -d example.com -d www.example.com
```

Certbot asks for an email address and for you to accept the terms, proves
control of each name, installs the certificate and adds the HTTPS settings to
your server's configuration. If you only want the files and will configure
the server yourself, use `certonly` instead:

```
sudo certbot certonly --nginx -d example.com
```

The files land in `/etc/letsencrypt/live/example.com/`:

| File | What it is |
|---|---|
| `fullchain.pem` | your certificate plus the intermediate: what the server sends |
| `privkey.pem` | the private key: never share it |

Point your server at `fullchain.pem`, not `cert.pem`. A server that sends
only its own certificate works in some browsers and fails in others and in
API clients, because they can't build the chain.

## Step 3: check renewal works

Certbot installs a timer that tries to renew twice a day and renews when a
certificate is close to expiry. Test it once now:

```
sudo certbot renew --dry-run
systemctl list-timers | grep certbot
```

Recent Certbot versions (4.1 and later) also ask Let's Encrypt when to renew
(ACME Renewal Information), so a certificate that has to be replaced early is
replaced automatically.

**After renewal, the server must load the new file.** `--nginx` and
`--apache` reload the server for you. With `certonly`, add a deploy hook:

```
sudo certbot renew --deploy-hook "systemctl reload nginx"
```

A certificate renewed on disk but never loaded is the most common way a
"working" setup expires anyway. See
[certificate renewed but not installed](/guides/certificate-renewed-but-not-installed).

## Wildcards need DNS validation

`*.example.com` can only be validated with DNS-01: Certbot creates a TXT
record at `_acme-challenge.example.com`. Do it with a DNS plugin for your
provider (Cloudflare, Route 53 and others have one) so renewals stay
automatic. A wildcard obtained with `--manual` won't renew on its own.

## Rate limits worth knowing

Let's Encrypt limits how many certificates you can get, mostly to stop
broken scripts:

- 50 new certificates per registered domain every 7 days;
- 5 duplicate certificates (the exact same names) every 7 days;
- 5 failed validations per name, per account, per hour.

Test changes with `--dry-run` (or `--staging`) first; failed attempts against
the real service count.

## What's changing

- **No more expiry emails.** Let's Encrypt stopped sending expiration
  reminders on 4 June 2025. Nothing tells you a renewal failed except your own
  monitoring.
- **No more OCSP.** Revocation is published only through CRLs since August
  2025. Nothing to change on a normal web server.
- **Shorter certificates.** Certificates last 90 days today. Let's Encrypt
  plans 64 days from 10 February 2027 and 45 days from 16 February 2028,
  following the industry move described in
  [47-day SSL certificates](/guides/47-day-ssl-certificates). Automated
  renewal with Certbot keeps working; anything renewed by hand won't.

## Check your domain

The [SSL expiry checker](/tools/ssl-expiry-checker) shows the certificate
every hostname actually serves and when it expires, and spots a certificate
that was renewed but never installed. Nameward's monitoring alerts you before
any of them lapse.

## Sources

- [Certbot instructions](https://certbot.eff.org/instructions)
- [Certbot user guide](https://eff-certbot.readthedocs.io/en/stable/using.html)
- [Let's Encrypt: challenge types](https://letsencrypt.org/docs/challenge-types/)
- [Let's Encrypt: rate limits](https://letsencrypt.org/docs/rate-limits/)
- [Let's Encrypt: ending expiration notification emails](https://letsencrypt.org/2025/01/22/ending-expiration-emails/)
- [Let's Encrypt: OCSP service has reached end of life](https://letsencrypt.org/2025/08/06/ocsp-service-has-reached-end-of-life)
- [Let's Encrypt: decreasing certificate lifetimes to 45 days](https://letsencrypt.org/2025/12/03/from-90-to-45/)
- [Certbot 4.1.0 release (ARI support)](https://community.letsencrypt.org/t/certbot-4-1-0-release/238369)

---
Source: https://nameward.app/guides/free-ssl-certificate-lets-encrypt (updated 2026-10-30)