Automatically Generate and Deploy SSL Certificates to Nginx with Certbot on Linux

1. Install Certbot

Certbot automates obtaining and managing SSL certificates from Let’s Encrypt. Install it together with the Nginx plugin using the system package manager.

Ubuntu/Debian

sudo apt update
sudo apt install certbot python3-certbot-nginx

CentOS/RHEL

sudo yum install epel-release
sudo yum install certbot python3-certbot-nginx

Fedora

sudo dnf install certbot python3-certbot-nginx

Verify the installation with certbot --version.

2. Configure Nginx

Ensure the Nginx virtual host points to the site root and that the domain’s DNS record resolves to the server IP.

Example server block

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/html; # website root
    index index.html index.htm;
    location / {
        try_files $uri $uri/ =404;
    }
}

Test the configuration with sudo nginx -t and reload Nginx with sudo systemctl reload nginx.

3. Obtain and Install the Certificate

Run Certbot with the Nginx plugin to request a certificate for the desired domains.

sudo certbot --nginx -d example.com -d www.example.com

The command contacts Let’s Encrypt, obtains the certificate, updates the Nginx configuration to listen on port 443 with SSL settings, and restarts Nginx. The --nginx flag tells Certbot to use the Nginx plugin; the -d options specify the domain names.

After a successful run you will see a message such as “Successfully obtained SSL certificate for example.com and www.example.com”.

4. Verify HTTPS Deployment

Visit https://example.com in a browser; the site should load over HTTPS with a lock icon. Use tools like SSL Labs’ SSL Test to validate the certificate configuration.

5. Set Up Automatic Renewal

Let’s Encrypt certificates are valid for 90 days, so renewal must be automated. Certbot installs a system timer that attempts renewal automatically. Check the timer status with: sudo systemctl status certbot.timer To test renewal manually, run: sudo certbot renew --dry-run This simulates renewal without affecting the live certificate.