Installing a free certificate with Certbot

Why Certbot is the Gold Standard for Free Certificate Issuance?

If you've ever dealt with the hassle of generating a CSR, submitting it to a certificate authority, and waiting for manual approval to enable HTTPS on your server, Certbot is exactly the tool that eliminates this process. Certbot is the official client of the Let's Encrypt project, and by fully automating the issuance, installation, and renewal process, it establishes a secure SSL/TLS connection on your server in just a few minutes.

In this article, we assume you are familiar with basic DNS and web server concepts but have no prior experience with Certbot. Our goal is that after reading this post, you will be able to install a free certificate on your server, configure automatic renewal, and troubleshoot any validation errors that may occur. If you're looking for a managed solution for hosting or cloud servers, ServerNet's hosting services also provide seamless support for Let's Encrypt certificates, but this article focuses on manual installation on a dedicated server or VPS.

Prerequisites for Installing Certbot

Before taking any action, make sure the following prerequisites are met:

• Root access or a user with sudo privileges on a Linux server (Ubuntu, Debian, CentOS, or Rocky Linux distributions)
• A domain whose A record points to your server's IP address. For HTTP validation, the domain must be accessible via port 80.
• A web server installed (Apache or Nginx) with its service running.
• Ports 80 and 443 open in the server firewall.

An important note: If your domain is behind a CDN or reverse proxy, first point the DNS record directly to your server's IP; otherwise, HTTP validation will fail.

Installing Certbot on Common Distributions

The installation method varies depending on your distribution. On Ubuntu and Debian, the official repositories include a stable version of Certbot:

sudo apt update
sudo apt install certbot python3-certbot-nginx

If your web server is Apache, use python3-certbot-apache instead of the nginx package. On CentOS or Rocky Linux, install using Snap:

sudo dnf install epel-release
sudo dnf install snapd
sudo systemctl enable --now snapd.socket
sudo snap install core; sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

After installation, verify the installation with the certbot --version command. If it displays the version, you're ready to issue a certificate.

Issuing a Certificate with HTTP Validation

The simplest way to issue a certificate is to use the web server plugin, which automatically places the validation file in the web root. For Nginx, run the following command:

sudo certbot --nginx -d example.com -d www.example.com

Certbot will ask whether you want to enable HTTP to HTTPS redirect. Choose option 2 to automatically redirect all traffic to the secure version. After a few seconds, a success message will appear along with the certificate storage path.

If you don't want Certbot to modify your web server configuration, you can use the webroot method:

sudo certbot certonly --webroot -w /var/www/example.com -d example.com

In this method, Certbot creates a temporary file in the /.well-known/acme-challenge/ directory, and Let's Encrypt checks it via HTTP. Make sure the -w path is exactly the web root of your domain.

DNS Validation for Special Domains

If your domain is behind a CDN, port 80 is closed, or you need a wildcard certificate, you must use DNS validation. This method requires adding a TXT record to your domain's DNS:

sudo certbot certonly --manual --preferred-challenges dns -d example.com -d "*.example.com"

Certbot will display a TXT value that you need to add to your domain's DNS management panel. After the record propagates (usually 30 seconds to a few minutes), press Enter to complete validation. This method is essential for wildcard certificates, but its automatic renewal requires scripting to update the DNS record automatically.

Configuring Automatic Certificate Renewal

Let's Encrypt certificates are only valid for 90 days, so automatic renewal is a necessity, not a choice. Fortunately, Certbot includes a system timer that checks twice a day whether a certificate needs renewal. To ensure it's active, run the following command:

sudo systemctl list-timers | grep certbot

If the timer is not active, enable it with the following command:

sudo systemctl enable --now certbot.timer

To test the renewal process manually, use the dry-run mode to make sure everything works without errors:

sudo certbot renew --dry-run

This command doesn't make any changes to your current certificate; it only simulates the renewal process. If the output includes a Congratulations message, automatic renewal will work correctly.

Fixing a Common Automatic Renewal Error

One of the most common automatic renewal issues is the Certbot failed to authenticate some domains error. This error usually occurs for one of the following reasons:

• The domain's DNS record has changed and no longer points to the server's IP.
• The firewall is blocking port 80.
• The web server is unavailable during renewal.

To troubleshoot, first check that the validation path is accessible from outside using the command curl -I http://example.com/.well-known/acme-challenge/test. If you receive a 404 response, the problem is with the web server configuration.

Common Validation Errors and Their Solutions

Below, we'll examine three frequent errors in the certificate issuance and renewal process.

"Too Many Certificates Issued for Exact Set of Domains" Error

This error means you've requested certificate issuance for the same domain more than 5 times in the past hour. Let's Encrypt has strict rate limits. The solution is to wait for the limit to reset (usually one hour) and then retry the request. To avoid this error, use the --dry-run command for testing and only make real requests when your configuration is final.

"Invalid Response From http://example.com/.well-known/acme-challenge/..." Error

This error indicates that Let's Encrypt couldn't retrieve the validation file from your server. The most common cause is a 301 redirect from HTTP to HTTPS. Certbot places the file on HTTP, but if the server automatically redirects to HTTPS, validation fails. To fix this, temporarily disable the redirect or use the DNS method.

"DNS problem: NXDOMAIN looking up A for example.com" Error

This error means your domain's A record doesn't exist or points to the wrong IP. Check the record with the command dig example.com A. If the output is empty, add the record in your DNS panel and wait for propagation. DNS propagation usually takes 5 to 30 minutes, but in some cases, it can take up to 48 hours.

Final Tips for Optimal Certificate Management

After a successful installation, here are a few tips for better maintenance:

• You'll find your certificates in the /etc/letsencrypt/live/example.com/ directory. The fullchain.pem file contains the complete certificate chain, and privkey.pem is your private key.
• Never place your private key in Git repositories or file-sharing services.
• To check your certificate's expiration date, use the command sudo certbot certificates.
• If you change your web server (e.g., from Nginx to Apache), the certificates are transferable, but you'll need to reconfigure the renewal settings.

By following these tips and using Certbot, you'll no longer worry about certificate expiration or manual errors. HTTPS is now an essential standard for any website, and with automated tools like Certbot, enabling it has become one of the simplest server management tasks.