If you have ever deployed a website with Nginx, you have probably noticed that getting the site to work over http:// is only half the job. These days, you generally want your website to be accessible through HTTPS. Apart from showing the familiar padlock in the browser, HTTPS encrypts the connection between your users and your server.

The good news is that you don’t need to manually generate certificates, configure every SSL directive in Nginx, and remember to renew everything every few months. That’s where Certbot comes in.

In this guide, we’ll go through how to set up HTTPS for a domain running behind Nginx using Certbot and Let’s Encrypt.

What is Certbot?

Certbot is a free tool from the Electronic Frontier Foundation (EFF) that automates the process of getting and renewing SSL/TLS certificates from Let’s Encrypt.

Without Certbot, you would have to deal with the certificate files yourself and manually configure Nginx to use them.

With Certbot, most of that work can be automated.

It can:

• Validate that you control the domain
• Request an SSL/TLS certificate from Let’s Encrypt
• Configure Nginx to use the certificate
• Set up automatic certificate renewal

The last point is especially important.

Let’s Encrypt certificates are only valid for 90 days. That might sound annoying at first, but the short lifetime is not really a problem when renewal is automated. You don’t have to remember to manually renew your certificate every few months.

Before You Start

Before installing Certbot, there are two things you should have working already.

1. Your domain points to the server

Your domain needs to have its DNS configured correctly.

For example, if you want to secure:

example.com

the domain should already point to your server through an appropriate DNS record, such as an A record.

If the domain isn’t pointing to the correct server yet, Certbot won’t be able to validate it.

2. Nginx is already serving your website

Nginx should already be installed and serving your website over HTTP, usually on port 80.

This is important because Certbot needs to verify that you actually control the domain before Let’s Encrypt issues the certificate.

So, before touching Certbot, make sure this works:

http://yourdomain.com

If the website isn’t accessible yet, fix the DNS or Nginx configuration first.

Installing Certbot

On an Ubuntu or Debian-based server, you can install Certbot and its Nginx plugin with:

sudo apt install certbot python3-certbot-nginx

The second package is important.

python3-certbot-nginx is the plugin that allows Certbot to work directly with your Nginx configuration.

Without it, Certbot can still obtain a certificate, but you would have to configure Nginx yourself afterward.

With the Nginx plugin, Certbot can handle that part for you.

Getting the SSL Certificate

Once your domain and Nginx configuration are ready, you can request the certificate with:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Let’s break this command down.

--nginx tells Certbot that you’re using Nginx and want it to configure Nginx automatically.

The -d options specify the domains that should be included in the certificate.

So in this example, the certificate covers both:

yourdomain.com
www.yourdomain.com

During the process, Certbot will ask for an email address. This is used for important certificate-related notifications, such as renewal problems.

It will also ask whether you want to redirect HTTP traffic to HTTPS.

If you choose the redirect option, someone visiting:

http://yourdomain.com

will automatically be sent to:

https://yourdomain.com

For most websites, this is what you want.

What Does Certbot Actually Change?

One thing that can feel confusing when using Certbot is that it doesn’t just create a certificate and leave you to figure out the rest.

When you use the Nginx plugin, Certbot modifies your Nginx configuration.

It adds a server block for HTTPS traffic on port 443 and configures it to use the certificate files that were issued by Let’s Encrypt.

If you selected the HTTP-to-HTTPS redirect, Certbot also adds the necessary redirect rule to your existing port 80configuration.

So instead of manually doing something like:

server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate ...;
    ssl_certificate_key ...;
}

Certbot handles the certificate-related configuration for you.

This is one of the main reasons using the Nginx plugin is convenient.

Checking If Everything Worked

Once Certbot finishes, the easiest test is simply opening your website:

https://yourdomain.com

If everything is configured correctly, your browser should show the HTTPS connection without any certificate warnings.

You can also check which certificates Certbot currently has installed:

sudo certbot certificates

This will show information about your certificates, including their domains and expiration dates.

Don’t Forget About Renewal

Getting the certificate is only the beginning.

Remember, Let’s Encrypt certificates are valid for 90 days. Fortunately, Certbot handles the renewal process automatically.

When Certbot is installed, it sets up a systemd timer that periodically checks whether your certificates need to be renewed.

It doesn’t renew the certificate every time it runs. Instead, it checks whether the certificate is getting close to expiration and renews it when necessary.

You can check whether the timer is running with:

sudo systemctl status certbot.timer

If the timer is active, Certbot can handle the renewal process without you having to manually run it every few months.

Testing Automatic Renewal

Even if the timer is running, it’s a good idea to test the renewal process.

You can do that with:

sudo certbot renew --dry-run

The --dry-run option performs a test renewal without actually replacing your existing certificate.

This is useful because it lets you find configuration or validation problems before they become an actual outage.

What If Something Goes Wrong?

This is usually the part that matters most when you’re actually deploying a server.

If Certbot fails during validation or renewal, don’t immediately assume that Certbot itself is broken.

Start by checking the basics:

1. Is the domain pointing to the correct server?
2. Is Nginx running?
3. Is the website accessible over HTTP?
4. Is port 80 reachable from the internet?
5. Is the Nginx configuration correct?
6. Is the certificate still valid?
7. Is the Certbot renewal timer running?

For example, if DNS hasn’t propagated yet, Let’s Encrypt may be unable to reach the server that is supposed to answer the validation request.

Similarly, if you have recently changed your Nginx configuration, a redirect or server block could interfere with the validation process.

The important thing is to troubleshoot the actual failure instead of blindly running Certbot again.

Final Takeaway

Setting up HTTPS with Nginx doesn’t have to involve manually managing certificates.

With Certbot, the process is fairly straightforward:

Domain
   ↓
DNS points to server
   ↓
Nginx serves the website
   ↓
Certbot validates the domain
   ↓
Let's Encrypt issues the certificate
   ↓
Certbot configures Nginx
   ↓
HTTPS

The biggest thing to remember is that certificate renewal matters just as much as the initial setup. Let’s Encrypt certificates only last 90 days, so make sure the Certbot renewal timer is working and test it with:

sudo certbot renew --dry-run

The next time HTTPS stops working, I’d start with the basics: DNS, Nginx, ports, and Certbot’s renewal status before changing anything else.