Certbot with Nginx: Install and Renew SSL Certificates
Install Certbot with sudo snap install --classic certbot, then run sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com to get a free Let’s Encrypt certificate and configure HTTPS. Certbot renews it automatically with a timer; confirm once with sudo certbot renew --dry-run, because certificate lifetimes are shrinking from 90 days.
For VPS and cloud server owners running Nginx who want free HTTPS that renews itself.
knowledge
- Read time
- 5 min
- Sections
- 8
- Updated
- 14 Nov 2026
- Written by
- WebJi® team
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What do you need before running Certbot on Nginx?
You need a domain whose A (and AAAA, if used) records point at the server, Nginx serving the site on port 80 with a matching server_name, ports 80 and 443 open, and SSH access with sudo. Certbot proves control of the domain by answering an HTTP-01 challenge on port 80.
- DNS:
dig +short yourdomain.com Areturns this server’s IP for every name you will put on the certificate. - Nginx: a server block with
listen 80;andserver_name yourdomain.com www.yourdomain.com;; the plugin uses that line to find the block. - Firewall:
sudo ufw allow 'Nginx Full'opens 80 and 443. Keep 80 open after issuance, because renewals use it too. - CAA: if the domain has CAA records, one must allow
letsencrypt.org; see CAA records explained.
How do you install Certbot for Nginx?
Certbot’s developers recommend the snap package: remove any apt-installed Certbot, install the snap, and link the command into your PATH. The snap updates itself and supports x86_64 and ARM servers.
sudo apt-get remove certbot # only if an OS package is installed
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/local/bin/certbot
certbot --versionThe distribution packages (sudo apt install certbot python3-certbot-nginx on Ubuntu or Debian) also work and include the Nginx plugin, but they can lag behind current releases. Use one method only; two installs lead to two renewal timers and confusing errors.
How do you get and install the certificate on Nginx?
Run sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com; Certbot answers the challenge, saves the certificate and edits the matching server block to serve HTTPS. Each -d adds a name to the same certificate.
sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
sudo nginx -t && sudo systemctl reload nginxOn the first run Certbot asks you to accept the terms and optionally give an email address. Files land in /etc/letsencrypt/live/yourdomain.com/: Nginx uses fullchain.pem and privkey.pem. If you prefer to edit Nginx yourself, sudo certbot certonly --nginx issues the certificate without changing any configuration.
| Command | What it does |
|---|---|
certbot certificates | Lists certificates, their names and expiry dates |
certbot --nginx --expand -d a.com -d www.a.com -d shop.a.com | Adds a name to an existing certificate |
certbot renew --dry-run | Tests renewal against the staging server |
certbot delete --cert-name a.com | Removes a certificate you no longer use |
How does Certbot renew certificates automatically?
Certbot installs a systemd timer or cron job that runs certbot renew regularly and renews each certificate when it enters its renewal window, so you only need to confirm it works. Test it once with a dry run after installing.
systemctl list-timers | grep certbot # snap: snap.certbot.renew.timer
sudo certbot renew --dry-run # "Congratulations, all simulated renewals succeeded"Do not rely on reminder emails: Let’s Encrypt stopped sending expiry notification emails in June 2025. Use an external monitor or the WebJi® SSL checker to watch the expiry date. Lifetimes are also shrinking: Let’s Encrypt certificates are 90 days today, its default profile moves to 64 days from 10 February 2027 and to 45 days from 16 February 2028, so manual renewal stops being practical. Let’s Encrypt auto-renew covers hooks and monitoring in more depth.
How do you force HTTPS in the Nginx configuration?
Accept Certbot’s redirect, or add a port-80 server block that returns a 301 to the HTTPS address. Then fix any page assets still loaded over http://, or browsers will show mixed-content warnings.
server {
listen 80;
listen [::]:80;
server_name yourdomain.com www.yourdomain.com;
return 301 https://$host$request_uri;
}Certbot serves its challenge from /.well-known/acme-challenge/; with the --nginx plugin it handles this itself, but a hand-written rule that rewrites every request, including that path, can break renewals. Once HTTPS is stable, enable HTTP/2 on Nginx in the 443 block.
How do you get a wildcard certificate with Certbot?
Wildcards need the DNS-01 challenge, so install the Certbot DNS plugin for your DNS provider and request both *.yourdomain.com and the bare domain. A wildcard covers one label only: *.example.com covers shop.example.com but not example.com or a.b.example.com.
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-cloudflare
sudo certbot certonly --dns-cloudflare \
--dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
-d "*.yourdomain.com" -d yourdomain.comKeep the credentials file readable only by root (chmod 600). If your DNS provider has no plugin, --manual --preferred-challenges dns works but cannot renew unattended. For a commercial alternative, WebJi® sells a Sectigo Positive SSL Wildcard at ₹7,500 a year before 18% GST.
How do you fix common Certbot errors on Nginx?
Most failures come from DNS pointing elsewhere, port 80 blocked, a redirect that swallows the challenge path, or a server_name that does not match. Check them in that order.
| Message | Likely cause | Check |
|---|---|---|
| Timeout during connect (likely firewall problem) | Port 80 closed | sudo ufw status; host firewall |
| Invalid response … 404 | Challenge path not served | Rewrite rules, wrong server block |
| DNS problem: NXDOMAIN | Name does not exist in DNS | dig yourdomain.com A |
| Could not automatically find a matching server block | server_name missing or different | sudo nginx -T | grep server_name |
| CAA record … prevents issuance | CAA does not allow Let’s Encrypt | dig CAA yourdomain.com |
| too many certificates already issued | Rate limit from repeated tests | Use --dry-run or --staging for testing |
Frequently asked questions
Is a Let’s Encrypt certificate as secure as a paid one?
The encryption is the same. Let’s Encrypt issues domain-validated certificates only; paid certificates add organisation or extended validation, warranties and longer support relationships. For most websites a free DV certificate is enough; free vs paid SSL explains when it is not.
Do I need to restart Nginx after renewal?
With the --nginx plugin, Certbot reloads Nginx after a successful renewal. If you issued with certonly or webroot, add --deploy-hook "systemctl reload nginx" once, and Certbot saves it in the renewal configuration so later renewals reload automatically.
Can I use Certbot on shared hosting?
Usually not, because it needs root access to the server. Shared hosting panels such as cPanel issue free certificates themselves through AutoSSL. Certbot is the tool for a VPS or cloud server where you control Nginx, such as WebJi® VPS hosting.
Where are the Certbot logs?
Certbot writes to /var/log/letsencrypt/letsencrypt.log, keeping older runs as numbered files. The log shows the exact challenge URL, the response Let’s Encrypt received and any hook output, which is the quickest way to see why a renewal failed.
Commands checked against certbot.eff.org and Let’s Encrypt announcements on 14 November 2026 · Reviewed by the WebJi® team, Jaipur.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. INR pricing, 18% GST shown before payment and 24/7 email support in Hindi and English — average first reply under 60 minutes.