You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
AnalyticsMarketingPersonalizationExternal media
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
Set Up Certbot on a Linux Server – Secure Your Websites with Let's Encrypt SSL
Learn how to secure your website with free SSL certificates using Certbot and Let's Encrypt for safe data transmission → Find out more now
10 November 20266 min read4 Views0 helpful
Introduction
SSL certificates are an essential part of the internet, ensuring that data is securely transmitted between client and host. In this guide, we show you how to set up the open-source tool Certbot to request free SSL certificates from the nonprofit certificate authority Let's Encrypt.
FAQ
Frequently asked questions
You need a Linux server and your own domain with access to the DNS settings. For each root domain or subdomain, you must create an A DNS record pointing to your Linux server's IP address.
Use the command sudo apt install certbot.
Certbot is an open-source tool that lets you request free SSL certificates from the nonprofit certificate authority Let's Encrypt.
Nginx is recommended because it is a high-performance and popular open-source web server. Setup help is available in the Linux Reverse Proxy guide.
Feedback
Was this article helpful?
Your feedback helps us prioritize and improve content.
0 of 0 Users found this article helpful.
Personal support
Need more help than the guide provides?
Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.
Navigation
Software
Preparation
To use Certbot, you need a Linux server and a domain you own. You must have access to the domain's DNS settings and must create an A DNS record for each root domain or subdomain you want to use, pointing to the IP address of your Linux server.
Certbot also offers additional plugins that let you set up certificates for domains with just one click—compatible with various web servers like Nginx or Apache. We recommend Nginx, as it is a high-performance and popular open-source web server. Help with setup can be found in our Linux Reverse Proxy guide.
Installation
Start by installing the open-source package Certbot, which allows you to request free SSL certificates from Let's Encrypt.
Code
sudo apt install certbot
Once Certbot is installed, you can request certificates for your domain(s). Let's Encrypt and Certbot offer different ACME challenges to verify domain ownership.
We strongly recommend the standard HTTP-01 method, as it enables automatic renewals. If you encounter issues, you can alternatively use the DNS-01 method, which is manual and does not support automatic renewal because it relies on verification via a TXT DNS record.
Tip
Use Web Server Plugins
If you use a web server like Nginx, Apache, or your own web server, we recommend jumping directly to the Web Server Plugins section below. There, we show how to use additional Certbot plugins for these web servers to perform a “one-click” installation and request certificates without stopping the web server.
HTTP-01 Challenge
With Certbot installed, you can now request certificates for your domain(s). In this example, we use standalone mode, where Certbot starts a temporary web server to perform the necessary actions. This means you must open port 80 in your firewall, and no other web servers or services may be running on port 80 so that the temporary web server can start and the challenge can be retrieved (hence the name HTTP in the challenge).
Use the --standalone parameter in the following command to tell Certbot to use the temporary web server.
After running the command, you may be guided through an initial interactive setup where you enter an email address for certificate communication, followed by an optional mailing list and acceptance of the terms of service.
Certbot now generates an ACME challenge and hosts it via the temporary web server. The Let's Encrypt servers then try to retrieve this from your server. If successful, the certificates are created and saved under /etc/letsencrypt/live/[your_domain].
You can now use the SSL certificates wherever you need them by simply specifying the local path to the certificates.
TXT DNS Record
If you have trouble verifying your domain using the HTTP-01 method, you can alternatively use the DNS-01 method, where you must create a TXT DNS record with a value provided by Let's Encrypt.
As mentioned, this method does not support automatic renewal, unless you set up your own infrastructure for it. Therefore, we recommend using the HTTP-01 method whenever possible.
Use the --preferred-challenges parameter in the following command to tell Certbot you want to use the DNS-01 method.
After running the command, you may be guided through an initial interactive setup where you enter an email address for certificate communication, followed by an optional mailing list and acceptance of the terms of service.
Certbot will then give you instructions on how to create a TXT DNS record with a specific value. The target hostname is typically _acme-challenge. followed by your domain (in this example, _acme-challenge.zapdocs.example.com). You will find the value in the console.
After creating the record, press Enter to continue. If everything is correct and the record has propagated, the certificates will be created and saved under /etc/letsencrypt/live/[your_domain].
Info
Please be patient, as DNS changes sometimes take a little time to propagate. Usually, this takes only a few minutes, but in rare cases, it can take longer.
You can now use the SSL certificates wherever you need them by simply specifying the local path to the certificates.
Web Server Plugins
Certbot offers various additional web server plugins that make certificate management even easier, as the plugins automatically adjust the relevant server blocks. To use a plugin, simply add the appropriate parameter to your certbot command.
Both methods use the HTTP-01 challenge and work basically the same way. When a plugin is used, Certbot first looks for the server block containing the requested domain as server_name. Then Certbot generates an ACME challenge and temporarily adds a location /.well-known/acme-challenge/... block to the server block configuration.
The Let's Encrypt servers then try to retrieve the challenge from your server. If successful, your certificate is generated and the web server’s server block configuration is automatically adjusted to use HTTPS (port 443) and include paths to the new certificates.
Nginx Plugin
Before using the plugin, make sure it is installed.
Code
sudo apt install python3-certbot-nginx
To use the Nginx plugin, use the --nginx parameter in your command as follows.
If you want to disable automatic “one-click” server block adjustments by Certbot, you can add the certonly parameter, e.g., certbot certonly.
Webroot Plugin
If you run your own local web server that does not use traditional web server software, you might want to use the webroot method to keep your web server running without stopping it.
To use the webroot plugin, use the --webroot parameter in your command. Additionally, you must specify the path to your web server root directory with -w [your_webserver_path] (short for --webroot-path).
A common webroot path is /var/www/html. You can also use this method for web servers like Nginx or Apache if you want to keep the web server running without automatic server block adjustments like with the native plugins.
Automatic Renewal
In most cases, Certbot sets up automatic certificate renewal for you—either via a cron job or a systemd timer. You can test this with the following command, which simulates renewal in dry-run mode:
Code
certbot renew --dry-run
Tip
As mentioned, the DNS-01 method does not support automatic renewal via Certbot unless you set up your own infrastructure. Therefore, we recommend using the HTTP-01 method whenever possible.
If everything works as expected, the test should succeed. To check or adjust automatic renewal, find the relevant cron job or timer in /etc/crontab/, /etc/cron.*/*, or via systemctl list-timers.
Manual Cron Job Setup
If automatic renewal is not set up, you can create it yourself via a cron job. Open the crontab with crontab -e. If this is your first time, you will be asked to select an editor—choose the first option /bin/nano.
In the opened Nano editor, add the following line to run renewal daily at 6 a.m. local time:
Code
0 6 * * * certbot renew
Save the file and exit Nano with CTRL + X, confirm with Y, and press ENTER.
Conclusion
You have successfully set up Certbot for your domain(s)—whether in standalone mode, via webroot, or with one of the plugins—and thus ensure secure data transmission via HTTPS on your website. If you have any questions or problems, our support team is available daily to assist you! 🙂
Server hosting from €2.49 / month, online instantly, DDoS protection included.
Preferred source on Google
