Certbot installs a free Let's Encrypt SSL certificate on Nginx in one command — sudo certbot --nginx — after a two-command install, and renews it automatically through a systemd timer you verify once with certbot renew --dry-run. Certificates are free and valid 90 days. If you would rather not run any of this, SSL certificates on WebJi® hosting ship included with the plan.
Prerequisites: Nginx, Domain and Ubuntu VPS
Four prerequisites, checked in order:
- A domain you control — ownership is proven via the HTTP-01 challenge visiting your domain.
- DNS pointing at the server — A records for @ (and www) to your VPS IP, propagated; test by loading the domain in a browser. The Nginx default page or your site means DNS and Nginx are ready.
- Nginx serving port 80 with a server block — the server_name line is how Certbot's plugin finds the right block; a minimal listen 80 block is enough to start.
- Firewall — ports 80 AND 443 open (ufw allow 'Nginx Full'): 80 for the challenge and redirects, 443 for the HTTPS it enables.
With those four true, the next step is two commands from finished — the SSL fundamentals explain what the certificate actually does.
Step 1: Install Certbot and the Nginx Plugin
On Ubuntu or Debian: sudo apt update, then sudo apt install certbot python3-certbot-nginx — that second package is the Nginx plugin, the part that finds your server block and edits it. The official alternative is the snap route: sudo snap install --classic certbot, then sudo ln -s /snap/bin/certbot /usr/local/bin/certbot (certbot.eff.org, read 30 October 2026). Pick one route and stay on it — the snap instructions ask you to remove an apt-installed certbot first. Verify with certbot --version.
Step 2: Obtain and Install the Certificate
Run sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com — each -d adds a name. Certbot answers the HTTP-01 challenge, asks for an email and the terms, then offers the redirect choice — option 2 (Redirect) for virtually every site. The certificate lands in /etc/letsencrypt/live/yourdomain.com/ and Certbot edits the server block itself, so finish with nginx -t && systemctl reload nginx and load https://yourdomain.com. Want the certificate without Certbot touching your config? sudo certbot certonly --nginx stops after issuing.
Step 3: Verify Auto-Renewal (Timer and Dry Run)
The installed package ships a systemd timer (or cron job) that runs certbot renew twice a day and renews any certificate inside its last 30 days. Check the timer with systemctl list-timers | grep certbot, then prove the whole path with sudo certbot renew --dry-run — "all simulated renewals succeeded" is the pass line. Let's Encrypt emails you at 20, 10 and 1 day before expiry if a renewal fails; that email is your cue to run the diagnostic sequence in the errors section below.
Force HTTPS Redirect in Nginx Config
Certbot's option 2 writes the redirect for you. By hand, put return 301 https://$host$request_uri; inside the port-80 server block and reload. Then view the page source for http:// images, stylesheets or scripts — the padlock stays broken until those are HTTPS too. Renewal should be automatic; if the padlock disappears, check that the certificate is still bound to this hostname.
Wildcard Certificates With DNS Challenge
HTTP-01 cannot issue wildcards: *.yourdomain.com needs the DNS-01 challenge. The one-off command is sudo certbot certonly -d "*.yourdomain.com" -d yourdomain.com --preferred-challenges dns --manual — the apex must be listed separately, and per the EFF glossary a wildcard covers single labels only, so *.example.com does not cover example.com or hello.goodbye.example.com. The manual challenge does not auto-renew; for unattended renewal, install a DNS-provider plugin such as certbot-dns-cloudflare with its credentials file, and the timer handles the rest.
Common Certbot Errors and Fixes
The recurring errors, decoded:
- 'Failed authorization … connection refused/timeout' — the challenge could not reach you: DNS not pointing here (dig yourdomain.com A), port 80 blocked (ufw status), or Nginx down.
- 'Timeout during connect (likely firewall)' — specifically port 80, sometimes closed post-issuance by hardening; renewal then dies quietly — the dry-run lesson.
- 'Invalid response … 404/redirect loop' — the challenge path misroutes: a catch-all redirect loop or an aggressive location rule; manual configs must exempt .well-known.
- 'Certificate not yet due for renewal' — not an error; renew happens inside the 30-day window — use --dry-run for testing.
- 'Could not automatically find a matching server block' — server_name does not match the certificate names; fix the block.
Rate limits: use staging or dry-run for experiments. The diagnostic sequence: certbot renew --dry-run → nginx -t → dig → ufw status, in that order.
Frequently Asked Questions
How do I install an SSL certificate on Nginx with Certbot?
Install Certbot and the Nginx plugin — sudo apt install certbot python3-certbot-nginx — then run sudo certbot --nginx and answer the prompts. Certbot obtains the certificate, edits the Nginx server block, sets the HTTPS redirect and reloads Nginx in the same pass; verify with sudo certbot renew --dry-run.
Is Let's Encrypt SSL free forever?
Yes. Let's Encrypt is a free certificate authority and Certbot is free, open-source software. The 90-day validity is a term, not a trial — the package's timer renews automatically, so the only cost of "forever" is the one-time renewal check: certbot renew --dry-run.
How do I auto-renew Let's Encrypt certificates?
You usually do nothing: the package installs a systemd timer that runs certbot renew twice a day and renews certificates inside their last 30 days. Verify once with systemctl list-timers | grep certbot and sudo certbot renew --dry-run. Expiry-warning emails at 20, 10 and 1 day mean the automatic path has failed — work the errors section above.
What is the certbot nginx plugin?
The Nginx plugin (the python3-certbot-nginx package) is the part of Certbot that reads your Nginx configuration, finds the server block whose server_name matches the certificate names, runs the HTTP-01 challenge, writes the SSL directives and the redirect, and reloads Nginx for you.
Why is my certificate renewal failing?
Work the diagnostic sequence in order: certbot renew --dry-run, then nginx -t, then dig yourdomain.com, then ufw status. The usual culprits are DNS no longer pointing at the server, port 80 closed (often by later hardening — renewal needs it too), a redirect loop swallowing the challenge path, or Let's Encrypt's rate limits during repeated testing — use --staging or the dry run for experiments.
How do I force HTTPS in Nginx?
Take Certbot's redirect option (option 2) during issuance, or add return 301 https://$host$request_uri; to the port-80 server block and reload Nginx. Then clear mixed content — any http:// image, stylesheet or script keeps the padlock broken.
Is WebJi® an Indian company?
Yes. WebJi® is headquartered in Jaipur, Rajasthan and has operated since 2005. Billing, support and governance all run from India.
Do you provide GST invoices?
Every purchase and renewal gets a GST invoice with our GSTIN, and hosting prices are quoted exclusive of 18% GST. Claim input credit as applicable.