Set Up HTTPS on Ubuntu in 10 Minutes with Certbot and Automatic 90‑Day Renewal

Why Certbot

Let’s Encrypt recommends Certbot, which can be installed directly from Ubuntu’s apt repository. The certificates are valid for 90 days and are automatically renewed 30 days before expiry without manual intervention.

apt update
apt install -y certbot python3-certbot-nginx

These commands install the Nginx plugin, inject certificate paths into the Nginx configuration, and set up automatic renewal with reload.

Practical example: On a fresh Ubuntu 22.04 server, the whole process from apt install to seeing the green lock in the browser took 4 minutes 30 seconds with zero manual configuration changes.

Three‑Minute Certificate Request

A single command requests both the primary domain and the www sub‑domain and writes the certificates into Nginx automatically:

certbot --nginx \
  -d yourdomain.com -d www.yourdomain.com \
  --non-interactive --agree-tos \
  -m [email protected]

Key flags: --nginx: modifies Nginx config automatically. --non-interactive: runs without interactive prompts. -m: sets the renewal notification email.

After success, the certificates are placed under /etc/letsencrypt/live/yourdomain.com/ with fullchain.pem, privkey.pem, and cert.pem.

Nginx Configuration Reference

Certbot writes the required directives; the template below shows the typical layout if manual tweaks are needed:

# HTTPS site
server {
    listen 443 ssl;
    server_name yourdomain.com www.yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    root /var/www/html;
    index index.html;
    location / {
        try_files $uri $uri/ =404;
    }
}

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name yourdomain.com www.yourdomain.com;
    return 301 https://$host$request_uri;
}

90‑Day Automatic Renewal

Certbot configures a systemd timer, so no cron job is needed. To inspect the timer: systemctl list-timers | grep certbot To test renewal without changing the live certificate: certbot renew --dry-run A successful dry‑run prints “Congratulations”, confirming the renewal path works.

Practical example: After three months in production, a dry‑run showed the certificate renewed from November to February automatically, with Nginx reloaded and no downtime.

Three Common Pitfalls

Pitfall 1: Redirect Loop

Error:

rewrite or internal redirection cycle while internally redirecting to "////////////"

. Cause: the root directory lacks an index.html, causing try_files to loop. Fix: place an index file in /var/www/html or point root to a directory that contains content.

Pitfall 2: Directory Permission Issues

Error: directory index of "/var/www/html/" is forbidden. Fix:

chmod -R 755 /var/www/yourdomain
chown -R www-data:www-data /var/www/yourdomain

Pitfall 3: Port 80/443 Conflict

If another service occupies port 80 or 443, Certbot’s HTTP‑01 challenge fails. Use netstat -tlnp | grep -E ':(80|443)' to identify the culprit, stop it, and free the port.

acme.sh as an Alternative

For DNS validation, internal domains, or environments without Python, acme.sh can be used:

# Issue certificate
~/.acme.sh/acme.sh --issue \
  -d yourdomain.com -d www.yourdomain.com \
  --webroot /var/www/html

# Install and set up auto‑reload
~/.acme.sh/acme.sh --install-cert -d yourdomain.com \
  --key-file /etc/ssl/private/yourdomain.key \
  --fullchain-file /etc/ssl/certs/yourdomain.crt \
  --reloadcmd "systemctl reload nginx"

acme.sh creates a cron job for renewal, providing the same hands‑off experience.

Conclusion

Certbot turns HTTPS setup from a specialized operations task into a single‑command operation: certificate issuance, Nginx configuration, automatic renewal, and reload are all handled automatically. Remember to ensure the root directory contains real files; otherwise, Nginx will generate a redirect loop error.