You decide which services we may enable for analytics, personalization, and external content.
We use cookies and similar technologies on our website to personalize content, embed external media, and better understand how individual areas are used.
Necessary cookies
These entries support essential functions such as security, stability, and form processing.
Optional sections
AnalyticsMarketingPersonalizationExternal media
Your data may be processed with your consent or on the basis of legitimate interests. In the cookie settings, you can reject or explicitly allow each optional category.
Some services process personal data in third countries. By consenting, you also agree to this transfer. You can find more information in our Privacy Policy.
You can reopen and change your selection at any time. · 1.0.2
VPS: Create an SSL Certificate (Let's Encrypt) for Linux Servers
Learn how to secure your website with free SSL certificates using Certbot and Let's Encrypt for secure data transmission → Learn more
10 November 20266 min read1 Views0 helpful
Introduction
SSL certificates are an essential part of the internet and ensure that data can be transmitted securely between a client and a host. In this guide, we'll show you how to set up the open-source tool Certbot to request free SSL certificates from the nonprofit certificate authority Let's Encrypt.
FAQ
Frequently asked questions
You need a Linux server, a domain you own, and access to its DNS settings. For every root domain or subdomain you want to use, create an A DNS record pointing to your Linux server's IP address.
Run sudo apt install certbot.
We recommend the HTTP-01 method because it supports automatic renewal. The manual DNS-01 method uses a TXT DNS record but does not support automatic renewal.
Yes. Certbot offers additional plugins for Nginx and Apache that let you set up a certificate in one click.
Feedback
Was this article helpful?
Your feedback helps us prioritize and improve content.
0 of 0 Users found this article helpful.
Personal support
Need more help than the guide provides?
Our ZAP support team knows your product — briefly describe your issue and we'll help you personally.
Navigation
VPS
Prerequisites
To use Certbot, you need a Linux server and a domain that you own. You must have access to the domain's DNS settings and must create an A DNS record for every root domain or subdomain you want to use, pointing to the IP address of your Linux server.
Certbot also offers additional plugins that let you set up a certificate for a domain in just one click, compatible with various web servers such as Nginx or Apache. We recommend Nginx because it's a high-performance, popular open-source web server. For help setting it up, see our Linux Reverse Proxy guide.
Installation
Start by installing the open-source package Certbot, which you can use to request free SSL certificates from Let's Encrypt.
Code
sudo apt install certbot
Once Certbot is installed, you can request certificates for your domain(s). Let's Encrypt and Certbot offer several ACME challenges to verify domain ownership.
We strongly recommend the default HTTP-01 method because it allows automatic renewals. If you run into problems with it, you can use the manual DNS-01 method instead. It uses a TXT DNS record but does not support automatic renewal.
Tip
Use web server plugins
If you're using a web server such as Nginx, Apache, or your own web server, we recommend jumping to the Web Server Plugins section below. There, we'll show you how to use additional Certbot plugins for these web servers to install and request certificates in one click, without having to stop the web server.
HTTP-01 challenge
With Certbot installed, you can now request certificates for your domain(s). In this example, we'll use standalone mode, in which Certbot starts a temporary web server to complete the challenge. To do this, you need to open port 80 in your firewall and ensure that no other web server or service is running on port 80, so the temporary web server can start and the challenge can be accessed (hence HTTP in the challenge name).
In the following command, use the --standalone parameter to tell Certbot to use the temporary web server.
After running the command, you may be guided through an initial interactive setup. You'll need to enter an email address for certificate-related communications, then choose whether to join an optional mailing list and accept the terms of service.
Certbot will now generate an ACME challenge and host it on the temporary web server. The Let's Encrypt servers will then try to retrieve it from your server. If successful, the certificates will be created and saved in the /etc/letsencrypt/live/[deine_domain] directory.
You can now use the SSL certificates wherever you need them by specifying the local path to the certificates.
TXT DNS record
If you're having trouble verifying your domain using the HTTP-01 method, you can use the DNS-01 method instead. To do so, create a TXT DNS record with a value provided by Let's Encrypt.
As mentioned above, this method does not support automatic renewal unless you set up your own infrastructure for it. That's why we recommend using the HTTP-01 method whenever possible.
In the following command, use the --preferred-challenges parameter to tell Certbot to use the DNS-01 method.
After running the command, you may be guided through an initial interactive setup. You'll need to enter an email address for certificate-related communications, then choose whether to join an optional mailing list and accept the terms of service.
Certbot will now give you instructions for creating a TXT DNS record with a specific value. The record name is typically _acme-challenge. followed by your domain (for example, _acme-challenge.zapdocs.example.com), and you'll find the value in the console.
After creating the record, press Enter to continue. If everything is correct and the record has propagated, the certificates will be created and saved in the /etc/letsencrypt/live/[deine_domain] directory.
Info
Please be patient, as DNS changes can take some time to propagate. This usually takes only a few minutes, but in rare cases it may take longer.
You can now use the SSL certificates wherever you need them by specifying the local path to the certificates.
Web server plugins
Certbot offers several additional web server plugins that make certificate management even easier by automatically adjusting the relevant server blocks. To use a plugin, simply add the appropriate parameter to your certbot command.
Both methods use the HTTP-01 challenge and work in much the same way. Certbot first looks for the server block that contains the requested domain as its server_name. Certbot then generates an ACME challenge and adds a temporary location /.well-known/acme-challenge/... block to the server block configuration.
The Let's Encrypt servers will then try to retrieve the challenge from your server. If successful, your certificate will be generated, and the server block configuration will be automatically updated to use HTTPS (port 443) and include the paths to the new certificates.
Nginx plugin
Before using the plugin, make sure it's installed.
Code
sudo apt install python3-certbot-nginx
To use the Nginx plugin, add the --nginx parameter to your command.
To disable Certbot's automatic one-click changes to server blocks, you can add the certonly parameter, for example, certbot certonly.
Webroot plugin
If you're using your own local web server that isn't standard software, you may want to use the Webroot method. This lets your web server keep running without having to stop it.
To use the Webroot plugin, add the --webroot parameter to your command. You also need to specify the path to the top-level directory of your web server using -w [dein_webserver_pfad] (short for --webroot-path).
A common Webroot path is /var/www/html. You can also use this method with web servers such as Nginx or Apache if you want to keep the web server running without automatic server block changes like those made by the native plugins.
Automatic renewal
In most cases, Certbot sets up automatic certificate renewal for you using a cron job and/or a systemd timer. You can test this with the following command, which performs a trial run using --dry-run.
Code
certbot renew --dry-run
Tip
As mentioned above, the DNS-01 method does not support automatic renewal via Certbot unless you set up your own infrastructure for it. That's why we recommend using the HTTP-01 method whenever possible.
The test should succeed if everything is set up correctly. To view or adjust automatic renewal, look for the relevant command in one of the following directories: /etc/crontab/, /etc/cron.*/* or by running systemctl list-timers.
Setting up a cron job manually
If automatic renewal isn't set up, you can add it yourself using a cron job. Open the crontab with crontab -e. If this is your first time, you'll be prompted to choose an editor. Select the first option, usually /bin/nano.
In the Nano editor, add the following line to run renewal every day at 6 a.m. local time.
Code
0 6 * * * certbot renew
Save the file and exit Nano by pressing CTRL + X, confirm with Y, and press ENTER.
Conclusion
You've successfully set up Certbot for your domain(s)—whether in standalone mode, using Webroot, or with one of the plugins—and your website can now securely transmit data over HTTPS. If you have questions or run into problems, our support team is here to help every day! 🙂
Server hosting from €2.49 / month, online instantly, DDoS protection included.
Preferred source on Google
