If you have ever deployed a website with Nginx, you have probably noticed that getting the site to work over http:// is only half the job. These days, you generally want your website to be accessible through HTTPS. Apart from showing the familiar padlock in the browser, HTTPS encrypts the connection between your users and your server.
The good news is that you don’t need to manually generate certificates, configure every SSL directive in Nginx, and remember to renew everything every few months. That’s where Certbot comes in.
In this guide, we’ll go through how to set up HTTPS for a domain running behind Nginx using Certbot and Let’s Encrypt.
What is Certbot?
Certbot is a free tool from the Electronic Frontier Foundation (EFF) that automates the process of getting and renewing SSL/TLS certificates from Let’s Encrypt.
Without Certbot, you would have to deal with the certificate files yourself and manually configure Nginx to use them.
With Certbot, most of that work can be automated.
It can:
- Validate that you control the domain
- Request an SSL/TLS certificate from Let’s Encrypt
- Configure Nginx to use the certificate
- Set up automatic certificate renewal
The last point is especially important.
Let’s Encrypt certificates are only valid for 90 days. That might sound annoying at first, but the short lifetime is not really a problem when renewal is automated. You don’t have to remember to manually renew your certificate every few months.
Before You Start
Before installing Certbot, there are two things you should have working already.
1. Your domain points to the server
Your domain needs to have its DNS configured correctly.
For example, if you want to secure:
example.comthe domain should already point to your server through an appropriate DNS record, such as an A record.
If the domain isn’t pointing to the correct server yet, Certbot won’t be able to validate it.
2. Nginx is already serving your website
Nginx should already be installed and serving your website over HTTP, usually on port 80.
This is important because Certbot needs to verify that you actually control the domain before Let’s Encrypt issues the certificate.
So, before touching Certbot, make sure this works:
http://yourdomain.comIf the website isn’t accessible yet, fix the DNS or Nginx configuration first.
Installing Certbot
On an Ubuntu or Debian-based server, you can install Certbot and its Nginx plugin with:
sudo apt install certbot python3-certbot-nginxThe second package is important.
python3-certbot-nginx is the plugin that allows Certbot to work directly with your Nginx configuration.
Without it, Certbot can still obtain a certificate, but you would have to configure Nginx yourself afterward.
With the Nginx plugin, Certbot can handle that part for you.
Getting the SSL Certificate
Once your domain and Nginx configuration are ready, you can request the certificate with:
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.comLet’s break this command down.
--nginx tells Certbot that you’re using Nginx and want it to configure Nginx automatically.
The -d options specify the domains that should be included in the certificate.
So in this example, the certificate covers both:
yourdomain.com
www.yourdomain.comDuring the process, Certbot will ask for an email address. This is used for important certificate-related notifications, such as renewal problems.
It will also ask whether you want to redirect HTTP traffic to HTTPS.
If you choose the redirect option, someone visiting:
http://yourdomain.comwill automatically be sent to:
https://yourdomain.comFor most websites, this is what you want.
What Does Certbot Actually Change?
One thing that can feel confusing when using Certbot is that it doesn’t just create a certificate and leave you to figure out the rest.
When you use the Nginx plugin, Certbot modifies your Nginx configuration.
It adds a server block for HTTPS traffic on port 443 and configures it to use the certificate files that were issued by Let’s Encrypt.
If you selected the HTTP-to-HTTPS redirect, Certbot also adds the necessary redirect rule to your existing port 80configuration.
So instead of manually doing something like:
server {
listen 443 ssl;
server_name yourdomain.com;
ssl_certificate ...;
ssl_certificate_key ...;
}Certbot handles the certificate-related configuration for you.
This is one of the main reasons using the Nginx plugin is convenient.
Checking If Everything Worked
Once Certbot finishes, the easiest test is simply opening your website:
https://yourdomain.comIf everything is configured correctly, your browser should show the HTTPS connection without any certificate warnings.
You can also check which certificates Certbot currently has installed:
sudo certbot certificatesThis will show information about your certificates, including their domains and expiration dates.
Don’t Forget About Renewal
Getting the certificate is only the beginning.
Remember, Let’s Encrypt certificates are valid for 90 days. Fortunately, Certbot handles the renewal process automatically.
When Certbot is installed, it sets up a systemd timer that periodically checks whether your certificates need to be renewed.
It doesn’t renew the certificate every time it runs. Instead, it checks whether the certificate is getting close to expiration and renews it when necessary.
You can check whether the timer is running with:
sudo systemctl status certbot.timerIf the timer is active, Certbot can handle the renewal process without you having to manually run it every few months.
Testing Automatic Renewal
Even if the timer is running, it’s a good idea to test the renewal process.
You can do that with:
sudo certbot renew --dry-runThe --dry-run option performs a test renewal without actually replacing your existing certificate.
This is useful because it lets you find configuration or validation problems before they become an actual outage.
What If Something Goes Wrong?
This is usually the part that matters most when you’re actually deploying a server.
If Certbot fails during validation or renewal, don’t immediately assume that Certbot itself is broken.
Start by checking the basics:
- Is the domain pointing to the correct server?
- Is Nginx running?
- Is the website accessible over HTTP?
- Is port
80reachable from the internet? - Is the Nginx configuration correct?
- Is the certificate still valid?
- Is the Certbot renewal timer running?
For example, if DNS hasn’t propagated yet, Let’s Encrypt may be unable to reach the server that is supposed to answer the validation request.
Similarly, if you have recently changed your Nginx configuration, a redirect or server block could interfere with the validation process.
The important thing is to troubleshoot the actual failure instead of blindly running Certbot again.
Final Takeaway
Setting up HTTPS with Nginx doesn’t have to involve manually managing certificates.
With Certbot, the process is fairly straightforward:
Domain
↓
DNS points to server
↓
Nginx serves the website
↓
Certbot validates the domain
↓
Let's Encrypt issues the certificate
↓
Certbot configures Nginx
↓
HTTPSThe biggest thing to remember is that certificate renewal matters just as much as the initial setup. Let’s Encrypt certificates only last 90 days, so make sure the Certbot renewal timer is working and test it with:
sudo certbot renew --dry-runThe next time HTTPS stops working, I’d start with the basics: DNS, Nginx, ports, and Certbot’s renewal status before changing anything else.
