How to Install Let’s Encrypt and Use It with Nginx on Ubuntu (Complete Guide)

How to Install Let’s Encrypt and Use It with Nginx on Ubuntu (Complete Guide)

Securing a website with HTTPS is no longer optional. Browsers warn users about insecure sites, search engines favor HTTPS, and modern security standards assume encryption by default. Thankfully, Let’s Encrypt makes it possible to get free, trusted SSL certificates, and Nginx integrates with it very well on Ubuntu.

In this article, we’ll walk through installing Let’s Encrypt on Ubuntu and configuring it with Nginx, step by step. This guide is written in a practical, human way, focusing on real-world usage—not just commands. We’ll also cover certificate renewal, firewall rules, permissions, and common problems you’re likely to encounter.

We’ll use infrarunbook.com as the example domain throughout.

---

What Is Let’s Encrypt (And Why You Should Use It)

Let’s Encrypt is a free, automated Certificate Authority (CA) that provides SSL/TLS certificates trusted by all major browsers. It removes cost and complexity from HTTPS adoption.

With Let’s Encrypt:

• Certificates are free
• Browsers trust them automatically
• Renewal is automated
• Setup is fast and production-ready

For most websites, there is no reason not to use Let’s Encrypt.

---

Before You Start: Prerequisites Checklist

Before installing Let’s Encrypt, make sure the following are already in place:

• ✅ Ubuntu server (20.04 / 22.04 recommended)
• ✅ Nginx installed and running
• ✅ Website accessible over HTTP
• ✅ Domain name pointing to your server IP
• ✅ Ports 80 and 443 open in firewall

If Nginx is not installed yet, complete that first:

👉 https://infrarunbook.com/article/how-to-install-nginx-on-ubuntu-2204-complete-step-by-step-guide

Only continue once your site works over HTTP.

---

How Let’s Encrypt Works (Quick Understanding)

Let’s Encrypt verifies that:

• You control the domain
• The domain resolves to your server
• Nginx can serve validation files

Once verified, it issues a certificate that:

• Is valid for 90 days
• Can be auto-renewed
• Is trusted by browsers

On Ubuntu + Nginx, this is handled by a tool called Certbot.

---

Step 1: Update the System

Always start with an updated package index:

sudo apt update

This avoids dependency and compatibility issues.

---

Step 2: Install Certbot and Nginx Plugin

Ubuntu provides Certbot via official repositories.

Install Certbot with the Nginx plugin:

sudo apt install certbot python3-certbot-nginx -y

This plugin allows Certbot to:

• Automatically detect Nginx configs
• Modify server blocks safely
• Reload Nginx when needed

---

Step 3: Confirm Firewall Allows HTTPS

If HTTPS traffic is blocked, certificate validation may fail.

Check firewall status:

sudo ufw status

If needed, allow Nginx traffic:

sudo ufw allow 'Nginx Full'

This opens both 80 and 443.

---

Step 4: Verify Nginx Server Block Is Correct

Your site config should already exist:

/etc/nginx/sites-available/infrarunbook.com

At minimum, your HTTP block should look like this:

server {
    listen 80;
    server_name infrarunbook.com www.infrarunbook.com;

    root /var/www/infrarunbook.com/public_html;
    index index.html;
}

Make sure:

• server_name

  matches your domain
• Site is enabled
• HTTP works in browser

Certbot depends on this.

---

Step 5: Obtain SSL Certificate Using Certbot

Now comes the main step.

Run:

sudo certbot --nginx -d infrarunbook.com -d www.infrarunbook.com

Certbot will:

1. Ask for an email address
2. Ask to agree to terms
3. Ask whether to redirect HTTP → HTTPS
4. Validate domain ownership
5. Install certificates
6. Reload Nginx

When Asked About Redirect

Choose:

2: Redirect

This automatically sets up HTTP → HTTPS redirection.

---

Step 6: Verify SSL Certificate Installation

After Certbot completes, check:

sudo nginx -t
sudo systemctl reload nginx

Open your browser and visit:

https://infrarunbook.com

You should see:

• 🔒 Lock icon
• No certificate warnings
• HTTPS enforced

---

Step 7: Understand Where Certificates Are Stored

Let’s Encrypt stores certificates here:

/etc/letsencrypt/live/infrarunbook.com/

Key files:

• fullchain.pem

  → Certificate + chain

• privkey.pem

  → Private key (keep secure)

⚠️ Never change permissions on private key files manually.

---

Step 8: Check Nginx SSL Configuration

Certbot automatically updates your config.

Your HTTPS block will look similar to:

server {
    listen 443 ssl;
    server_name infrarunbook.com www.infrarunbook.com;

    ssl_certificate /etc/letsencrypt/live/infrarunbook.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/infrarunbook.com/privkey.pem;

    root /var/www/infrarunbook.com/public_html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

This is a clean and correct setup.

---

Step 9: Test Certificate from Command Line

Use

curl

:

curl -I https://infrarunbook.com

You should see:

HTTP/2 200

No SSL errors.

---

Step 10: Enable Auto-Renewal (Very Important)

Let’s Encrypt certificates expire every 90 days.

Certbot sets up a system timer automatically.

Check it:

systemctl list-timers | grep certbot

Test renewal manually:

sudo certbot renew --dry-run

If this succeeds, renewal will work automatically.

---

Common Problems and Troubleshooting

Let’s cover real issues admins face.

---

Problem 1: Certbot Fails Domain Validation

Causes

• DNS not pointing to server
• Port 80 blocked
• Wrong

  server_name

Fix

• Verify DNS:

  dig infrarunbook.com
  

• Open port 80
• Ensure correct Nginx config

---

Problem 2: HTTPS Works but HTTP Doesn’t Redirect

Cause

• Redirect option skipped
• Old server block still active

Fix

• Add explicit HTTP → HTTPS redirect
• Reload Nginx

---

Problem 3: SSL Certificate Expired

Cause

• Auto-renewal failed
• Server down during renewal

Fix

sudo certbot renew

Check logs:

/var/log/letsencrypt/letsencrypt.log

---

Problem 4: Permission Errors After SSL

Cause

• Incorrect website file permissions
• Manual changes after setup

Fix

sudo chown -R www-data:www-data /var/www/infrarunbook.com
sudo find /var/www/infrarunbook.com -type d -exec chmod 755 {} \;
sudo find /var/www/infrarunbook.com -type f -exec chmod 644 {} \;

---

Firewall & SSL (Often Overlooked)

Ensure:

• Port 80 → open (for renewal)
• Port 443 → open (for HTTPS)

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

---

Best Practices When Using Let’s Encrypt with Nginx

• Always test config before reload
• Monitor certificate expiry
• Keep port 80 open (even if redirecting)
• Do not manually edit cert files
• Use strong permissions
• Combine with HSTS only after testing

---

Final Thoughts

Installing Let’s Encrypt with Nginx on Ubuntu is one of the best security upgrades you can make to a website. It’s free, trusted, and easy to automate. When done properly, HTTPS becomes invisible to users—but invaluable for security and SEO.

For infrarunbook.com, this setup forms the foundation for:

• HTTP → HTTPS redirection
• HSTS
• Secure cookies
• Modern browser compatibility