Certbot with Nginx: Install and Renew SSL Certificates

Prerequisites: Nginx, Domain and Ubuntu VPS

Three prerequisites, checked in order:

• A domain you control — ownership is proven via the HTTP-01 challenge visiting your domain.

• DNS pointing at the server — A records for @ (and www) to your VPS IP, propagated; test by loading the domain in a browser. The Nginx default page or your site means DNS and Nginx are ready.

• Nginx serving port 80 with a server block — the server_name line is how Certbot's plugin finds the right block; a minimal listen 80 block is enough to start.

• Firewall — ports 80 AND 443 open (ufw allow 'Nginx Full'): 80 for the challenge and redirects, 443 for the HTTPS it enables.

With those four true, the next step is two commands from finished — the SSL fundamentals explain what the certificate actually does.

Step 1: Install Certbot and the Nginx Plugin

Two commands do the work once the prerequisites hold (domain DNS pointed at the server, Nginx serving port 80, firewall open on 80 and 443):

1. Install: sudo apt update && sudo apt install certbot python3-certbot-nginx — the plugin reads and edits your Nginx config automatically. On snap-enabled Ubuntu, snap install --classic certbot is the official alternative; pick one and stay consistent.
2. Obtain and install: sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com — each -d adds a name. Certbot runs the HTTP-01 challenge, asks for an email, and offers the redirect choice — option 2 (Redirect) for virtually every site.
3. Verify: nginx -t && systemctl reload nginx, then load https://yourdomain.com — issued free in under a minute, valid 90 days, renewing automatically via the systemd timer (certbot renew --dry-run proves it).

Step 2: Obtain and Install the Certificate

Two practical notes on Let's Encrypt: it interacts directly with caching and database response, and misconfiguration is the most common cause of 'hosting is slow' tickets. WebJi® support checks it as part of standard migrations.

Step 3: Verify Auto-Renewal (Timer and Dry Run)

On Nginx, the honest summary is that defaults matter more than brand names — a well-set budget plan outranks a mis-tuned premium one. WebJi® documents its defaults openly and adjusts them per ticket when workloads need it.

Force HTTPS Redirect in Nginx Config

Install the certificate on the account that actually serves the site, force HTTPS, then view the page source for http:// images, stylesheets or scripts. The padlock stays broken until those are HTTPS too. Renewal should be automatic; if the padlock disappears, check that the certificate is still bound to this hostname.

Wildcard Certificates With DNS Challenge

Set the nameservers at the registrar, then edit records only in the DNS host those nameservers point at. Editing the other panel does nothing. A website and its mail can use different hosts: the A record sends the site, MX sends the mail.

Common Certbot Errors and Fixes

The recurring errors, decoded:

• 'Failed authorization … connection refused/timeout' — the challenge could not reach you: DNS not pointing here (dig yourdomain.com A), port 80 blocked (ufw status), or Nginx down.

• 'Timeout during connect (likely firewall)' — specifically port 80, sometimes closed post-issuance by hardening; renewal then dies quietly — the dry-run lesson.

• 'Invalid response … 404/redirect loop' — the challenge path misroutes: a catch-all redirect loop or an aggressive location rule; manual configs must exempt .well-known.

• 'Certificate not yet due for renewal' — not an error; renew happens inside the 30-day window — use --dry-run for testing.

• 'Could not automatically find a matching server block' — server_name does not match the certificate names; fix the block.

Rate limits: use staging or dry-run for experiments. The diagnostic sequence: certbot renew --dry-run → nginx -t → dig → ufw status, in that order.