How to Set Up Free Let's Encrypt SSL with Certbot & Nginx on Ubuntu

The Importance of Modern HTTPS Encryption

HTTPS is no longer optional. Modern browsers flag unencrypted HTTP websites as "Not Secure," damaging user trust and negatively impacting Google organic search rankings. Let's Encrypt provides free, automated, and open X.509 certificates that can be deployed via the official EFF Certbot client in minutes.

Prerequisites

• An Ubuntu 22.04 or 24.04 server running Nginx.
• A fully qualified domain name (e.g. example.com and www.example.com) with DNS A records pointed to your server's public IP.
• Firewall ports 80 (HTTP) and 443 (HTTPS) open in UFW.

Step 1: Installing Certbot via Snap

The Electronic Frontier Foundation (EFF) officially recommends installing Certbot through Snap to ensure you always have the latest TLS cipher specifications:

# Ensure Snap core is up to date
sudo snap install core; sudo snap refresh core

# Remove any legacy apt certbot packages
sudo apt remove -y certbot

# Install Certbot via classic snap
sudo snap install --classic certbot

# Create symlink for standard PATH execution
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Step 2: Configuring Nginx Server Block

Ensure your Nginx configuration contains the exact domain names you want to certify. Open your site's configuration file:

sudo nano /etc/nginx/sites-available/example.com

Configure the basic HTTP virtual host:

server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    root /var/www/example.com/html;
    index index.html index.htm index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

Verify syntax and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx

Step 3: Obtaining the SSL Certificate via Certbot Nginx Plugin

Run Certbot with the automated Nginx plugin:

sudo certbot --nginx -d example.com -d www.example.com

Certbot will prompt you for:

1. An email address for urgent security notices and certificate expiration reminders.
2. Agreement to the Let's Encrypt Terms of Service.
3. Whether to redirect HTTP traffic automatically to HTTPS (always choose Redirect).

Step 4: Hardening Nginx SSL Configuration for an A+ Rating

To eliminate deprecated ciphers like TLS 1.0/1.1 and weak CBC ciphers, create an SSL parameters snippet:

sudo nano /etc/nginx/snippets/ssl-params.conf

Paste the hardened TLS directives:

ssl_protocols TLSv1.2 TLSv1.3;
ssl_prefer_server_ciphers off;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384";

# SSL session caching for rapid handshakes
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;

# OCSP Stapling
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

# Security Headers (HSTS, X-Frame, X-Content-Type)
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "no-referrer-when-downgrade" always;

Step 5: Testing Automatic Renewal

Certbot configures a background systemd timer that runs twice daily and renews any certificate within 30 days of expiration. Test the dry run to ensure renewals will succeed without human intervention:

sudo certbot renew --dry-run

Frequently Asked Questions (FAQ)

What should I do if Certbot renewal fails?

The most common cause of renewal failure is port 80 being closed by a firewall or another service binding port 80. Ensure UFW allows port 80 with sudo ufw allow 80/tcp.

Can I get a wildcard SSL (*.yourdomain.com) with Certbot?

Yes. Wildcard certificates require DNS-01 challenge verification. You can automate this using Certbot's Cloudflare DNS plugin: sudo apt install -y python3-certbot-dns-cloudflare.