0%
Loading...
NolimitHost

How to set up SSL/TLS with Nginx using Certbot

Last updated: March 29, 2026

Tested on: Ubuntu 22.04 & 24.04 LTS. Works on most Linux distributions where Certbot and Nginx are available.

This guide enables HTTPS (SSL/TLS) on your Nginx website using Let's Encrypt and Certbot. It's a follow-up to the Nginx installation guide - you should already have Nginx running with a website configured.

Prerequisites:
  • Nginx installed with your website running
  • Your domain DNS pointing to your VPS IP
  • Ports 80 and 443 will be opened during setup

Step 1: Update System & Install Certbot

Update packages:

sudo apt update && sudo apt upgrade -y

Install Certbot and the Nginx plugin:

sudo apt install -y certbot python3-certbot-nginx

Step 2: Open HTTPS in Firewall

Allow both HTTP and HTTPS traffic:

sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'
sudo ufw status

You should see both "Nginx Full" rules listed.

Step 3: Request SSL Certificate

Run Certbot to get a certificate and automatically configure Nginx:

sudo certbot --nginx -d example.com -d www.example.com

Replace example.com with YOUR domain and www.example.com if applicable.

Step 4: Follow the Certbot Prompts

Email address: Enter a valid email for renewal notifications

Accept Terms: Type A for agree

EFF Newsletter: Type Y or N based on preference

Redirect HTTP to HTTPS: Type 2 to automatically redirect all HTTP traffic to HTTPS (recommended)

Certbot will congratulate you when done. Your site is now HTTPS-enabled!

Step 5: Verify SSL is Working

Visit your site with HTTPS:

https://example.com

You should see a green padlock in your browser.

Test your SSL rating at SSL Labs.

How Certbot Modified Your Nginx Configuration

Certbot automatically updated your Nginx config with two server blocks:

HTTPS Block (secure): Listens on port 443 with your SSL certificate

HTTP Block (redirect): Listens on port 80 and redirects all traffic to HTTPS

View your config to see the changes:

sudo cat /etc/nginx/sites-available/example.com

Certificate Renewal

Let's Encrypt certificates expire every 90 days. Certbot auto-renews them:

Check auto-renewal status:

sudo systemctl status certbot.timer

Test the renewal process (dry run):

sudo certbot renew --dry-run

Manually renew if needed:

sudo certbot renew

Troubleshooting

DNS not resolving? Certbot needs your domain to point to your VPS IP. Verify with: nslookup example.com
Port 443 access issue? Verify firewall: sudo ufw status should show "Nginx Full" allowed.
Certificate renewal fails? Check that ports 80 and 443 are open. Certbot needs these for renewal verification.

Securing Your Site Further

After SSL is set up, consider:

  • HSTS: Add STS headers to force HTTPS in future visits
  • Regular backups: Backup your Nginx configs and website files
  • Keep updated: Run updates regularly with sudo apt update && sudo apt upgrade

Need Help?

For SSL/TLS setup assistance, please open a support ticket through your billing panel.