How to Generate Free Let's Encrypt SSL Certificates Using Certbot (Nginx & Apache Guide)

Before getting started, make sure you have:

• 🌐 A registered domain name pointing to your server
• 🖥️ Ubuntu, Debian, CentOS, or macOS
• 🔑 SSH access to your server
• 🌍 Port 80 and 443 open
• ⚡ Nginx or Apache installed (optional but recommended)
  

🚀 Step 1: Install Certbot

First, install Certbot on your local machine or server.

Debian / Ubuntu

Command

sudo apt update

sudo apt install certbot -y

CentOS / RHEL

Command

sudo yum install certbot -y

macOS

Command

brew install certbot

Once the installation is complete, verify it using:

Command

certbot --version

If the version is displayed successfully, you're ready for the next step.

🔐 Step 2: Generate SSL Certificates

Certbot provides multiple ways to generate SSL certificates depending on your server setup.

Method 1 — Standalone Mode (Recommended)

This method temporarily starts its own web server to verify your domain.

Before generating the certificate, stop your web server.

For Nginx

sudo systemctl stop nginx

For Apache

sudo systemctl stop apache2

Now generate the certificate.

Command

sudo certbot certonly --standalone

Follow the prompts:

• Enter your email address
• Accept the Terms of Service
• Enter your domain name

Once verification succeeds, Certbot generates your SSL certificate.

Finally, restart your web server.

For Nginx

sudo systemctl start nginx

For Apache

sudo systemctl start apache2

Method 2 — Manual Verification

If your server cannot use standalone mode, you can verify ownership manually.

Run the following command.

Command

sudo certbot certonly --manual -d yourdomain.com

Replace yourdomain.com with your actual domain name.

Certbot will display a filename and a verification token.

For example:

File Name: g3jlARuC4m23POLYoJH-JXG_ywR01JVJXXGF3EjvObc Content: g3jlARuC4m23POLYoJH-JXG_ywR01JVJXXGF3EjvObc.PiNQwzWVFMim4YcuIfTicSSVrW9vmdWH9GpjpWQ4VcU

📂 Step 3: Create the Verification File

Navigate to your website's root directory.

For most Linux servers, the default location is:

/var/www/html/

Create the following directory if it doesn't already exist.

.well-known/acme-challenge

Inside the acme-challenge directory, create a new file using the filename provided by Certbot.

Paste the verification content into the file exactly as shown in the terminal.

🔓 Step 4: Grant Folder Permission

Give the verification directory the appropriate permissions.

Command

sudo chmod -R 777 .well-known

🌍 Step 5: Verify the Challenge File

Before continuing, make sure the file is publicly accessible.

Open the following URL in your browser.

http://yourdomain.com/.well-known/acme-challenge/<file-name>

If the verification content is displayed correctly, return to the terminal and press Enter.

Certbot will now validate the domain and generate the SSL certificates.

📁 Step 6: Locate the Generated Certificates

After successful verification, the certificates are stored in:

/etc/letsencrypt/live/yourdomain.com/

The most commonly used files are:

• 📄 fullchain.pem
• 🔑 privkey.pem

If your certificates need to be copied to another server, you can use the scp command.

⚙️ Step 7: Configure SSL in Nginx

Open your Nginx configuration file.

/etc/nginx/sites-available/default

Update the SSL configuration.

ssl_certificate ssl_certificate_key

Point both directives to your generated certificate files.

Save the configuration and restart Nginx.

Command

sudo systemctl restart nginx

⚙️ Step 8: Configure SSL in Apache

Open the Apache configuration file.

/etc/apache2/sites-available/default.conf

Update the following directives.

SSLCertificateFile SSLCertificateKeyFile SSLCACertificateFile

Save the file and restart Apache.

Command

sudo systemctl restart apache2

🔄 Step 9: Renew SSL Certificates

Let's Encrypt certificates expire every 90 days.

To renew them manually, run:

Command

sudo certbot renew

After renewal completes successfully, restart your web server.

Nginx

sudo systemctl restart nginx

Apache

sudo systemctl restart apache2