Install Let's Encrypt on Nginx Ubuntu: free HTTPS in 10 minutes

SSL/TLS certificates stopped being a luxury a long time ago — Chrome flags any HTTP site as “Not secure” since 2018, mobile browsers won’t even let you POST without TLS, and Google penalizes HTTP in search ranking. Let’s Encrypt solved the cost problem (free certificates) and the operational one (automatic renewal), but correct configuration on Nginx still trips many people up because of DNS details, command ordering and outdated cipher suites.

This tutorial shows how to install and configure Let’s Encrypt on Nginx running Ubuntu 24.04 LTS, from scratch to an A+ grade on SSL Labs. We cover the parts usually skipped: pre-validating DNS, HTTP→HTTPS redirect without loops, renewal tested with --dry-run, and a reload hook so Nginx picks up the new cert with no manual intervention.

Estimated time: 10 to 15 minutes if DNS is already propagated. If you just created the A record, wait for propagation to complete before starting — otherwise the HTTP-01 challenge fails and you burn rate-limit quota for nothing.

Prerequisites

Before continuing, validate that your domain resolves to the correct IP. Run dig +short yourdomain.com on your local machine — the result must be the server’s public IP. If it comes back empty or with a different IP, the problem is in DNS and no step in this tutorial will work until you fix it there.

Installing Certbot

Certbot is the official Let’s Encrypt client and the recommended way to issue and renew certificates. Ubuntu 24.04 ships a version in apt, but the Electronic Frontier Foundation recommends installing via snap to ensure automatic updates — the client evolves quickly and old versions can break with changes in the ACME protocol.

sudo apt update
sudo apt install -y snapd

sudo apt remove -y certbot python3-certbot-nginx

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

certbot --version

Configuring Nginx for the HTTP-01 challenge

Let’s Encrypt validates domain ownership through a file that must be served at http://yourdomain.com/.well-known/acme-challenge/. Certbot’s --nginx plugin edits your vhost automatically, but to do so it needs a valid server block listening on port 80 with the correct server_name.

server {
    listen 80;
    listen [::]:80;
    server_name yourdomain.com www.yourdomain.com;

    root /var/www/yourdomain.com;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

sudo ln -s /etc/nginx/sites-available/yourdomain.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Issuing the certificate

With Nginx serving the domain on port 80, Certbot can complete the challenge. The command below issues the certificate, installs the SSL directives in the vhost and automatically sets up the HTTP→HTTPS redirect.

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Configuring automatic renewal

Let’s Encrypt certificates expire in 90 days. The Certbot snap already creates a systemd timer that tries to renew twice a day — but it’s prudent to validate it’s working and add the Nginx reload hook.

sudo systemctl list-timers | grep certbot

sudo systemctl enable --now snap.certbot.renew.timer

sudo mkdir -p /etc/letsencrypt/renewal-hooks/deploy
echo '#!/bin/bash
systemctl reload nginx' | sudo tee /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh
sudo chmod +x /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh

sudo certbot renew --dry-run

Final verification

With everything configured, validate your HTTPS security level on SSL Labs. Visit https://www.ssllabs.com/ssltest/analyze.html?d=yourdomain.com and wait 1-2 minutes for the analysis to complete. The expected grade is A. To reach A+, edit your vhost and add the security headers to the server block (already there, created by Certbot):

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;

Reload Nginx with sudo systemctl reload nginx and rerun the SSL Labs test.

Troubleshooting

Error “Connection refused” on the HTTP-01 challenge

This means Certbot couldn’t reach port 80 of your server. Check with sudo ufw status whether the firewall allows the port, and check whether another service (Apache, another Nginx) is conflicting. Kill the conflict with sudo ss -tlnp | grep :80.

Error “DNS problem: NXDOMAIN looking up A”

DNS hasn’t propagated yet or the A record doesn’t exist. Confirm locally with dig +short yourdomain.com @8.8.8.8 (uses Google’s public DNS). If it returns empty, go to your registrar’s panel and create the A record pointing to the server’s IP.

Cert renewed but browser still shows the old one

Confirm the reload hook is executable and working. Force renewal ignoring the cooldown with sudo certbot renew --force-renewal and check the output. If the hook doesn’t run, the problem is in /etc/letsencrypt/renewal-hooks/deploy/reload-nginx.sh — check permissions with ls -la.

Next steps

With HTTPS running, consider the next hardening steps: configure OCSP Stapling to reduce revocation check latency, add a Content Security Policy to mitigate XSS, and enable HTTP/2 or HTTP/3 on Nginx (already enabled by default on the 1.25+ line). For serious production, monitor certificate expiration with Uptime Robot or similar — an alert independent of the renewal cron.

If you are putting a critical application into production, a Hostini VPS delivers automatic snapshots, native IPv6 and a network firewall already configured to shorten the path between apt install nginx and the site live with an A+ grade.