How to Secure an Nginx Web Server with Let’s Encrypt SSL Certificates on Ubuntu

Securing your website with HTTPS is no longer optional; it is a fundamental requirement for modern web hosting. Search engines penalize unencrypted sites, and modern browsers display prominent security warnings to users. Fortunately, Let’s Encrypt provides free, automated SSL/TLS certificates, and the Certbot utility makes installing them on an Ubuntu Nginx server incredibly simple.

Prerequisites

Before proceeding, you must have:

• An Ubuntu server with Nginx installed and running.
• A registered domain name pointing to your server’s public IP address (both the A record for the root domain and the www record).
• An Nginx server block (virtual host) properly configured for your domain.

Step 1: Install Certbot and the Nginx Plugin

Certbot is the official client for Let’s Encrypt. The easiest way to install it on modern Ubuntu releases is via the snap package manager, which ensures you have the latest version.

sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot

Next, link the Certbot executable to your system path so you can run it from anywhere:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Step 2: Obtain the SSL Certificate

Certbot includes an Nginx plugin that automatically handles the certificate request, validation, and Nginx configuration changes.

Run the following command, replacing example.com with your actual domain:

sudo certbot --nginx -d example.com -d www.example.com

You will be prompted to enter an email address (for urgent renewal and security notices) and to agree to the Terms of Service. Certbot will then communicate with the Let’s Encrypt servers, verify that you control the domain, and download the certificates.

Step 3: Verify Auto-Renewal

Let’s Encrypt certificates are only valid for 90 days. This short lifespan encourages automation and limits damage if a key is compromised. The Certbot snap package automatically creates a systemd timer to handle renewals in the background.

You can verify that the auto-renewal process works by executing a dry run:

sudo certbot renew --dry-run

If the dry run succeeds without errors, your Nginx server is permanently secured. The system will seamlessly renew the certificate and reload Nginx before the 90-day expiration date.