First, add the repository.
sudo add-apt-repository ppa:certbot/certbotYou'll need to press ENTER to accept. Then, update the package list to pick up the new repository's package information.
sudo apt-get updateAnd finally, install Certbot's Nginx package with apt-get.
sudo apt-get install python-certbot-nginxCertbot is now ready to use, but in order for it to configure SSL for Nginx, we need to verify some of Nginx's configuration.
Certbot can automatically configure SSL for Nginx, but it needs to be able to find the correct server block in your config. It does this by looking for a server_name directive that matches the domain you're requesting a certificate for.
If you're starting out with a fresh Nginx install, you can update the default config file. Open it with nano or your favorite text editor.
sudo nano /etc/nginx/sites-available/default
Find the existing server_name line and replace the underscore, _, with your domain name:
/etc/nginx/sites-available/default
. . .
server_name example.com www.example.com;
. . .
Save the file and quit your editor.
Then, verify the syntax of your configuration edits.
sudo nginx -tIf you get any errors, reopen the file and check for typos, then test it again.
Once your configuration's syntax is correct, reload Nginx to load the new configuration.
sudo systemctl reload nginxCertbot will now be able to find the correct server block and update it. Next, we'll update our firewall to allow HTTPS traffic.
To additionally let in HTTPS traffic, we can allow the Nginx Full profile and then delete the redundant Nginx HTTP profile allowance:
sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'Your status should look like this now:
sudo ufw statusCertbot provides a variety of ways to obtain SSL certificates, through various plugins. The Nginx plugin will take care of reconfiguring Nginx and reloading the config whenever necessary:
sudo certbot --nginx -d example.com -d www.example.comThis runs certbot with the --nginx plugin, using -d to specify the names we'd like the certificate to be valid for.
Let's Encrypt's certificates are only valid for ninety days. This is to encourage users to automate their certificate renewal process. The certbot package we installed takes care of this for us by running ‘certbot renew’ twice a day via a systemd timer. On non-systemd distributions this functionality is provided by a script placed in /etc/cron.d. This task runs twice a day and will renew any certificate that's within thirty days of expiration.
To test the renewal process, you can do a dry run with certbot:
sudo certbot renew --dry-run
OR
sudo certbot renew --force-renewalsource: