Skip to main content
Back to Category

SSL/TLS Certificate Setup: Let's Encrypt Complete Guide

Install free SSL/TLS certificates with Let's Encrypt and Certbot on Nginx and Apache. Covers auto-renewal, HTTPS configuration, and troubleshooting common errors.

Read time: 12 min Server Management
ssltlslets encryptcertbothttpscertificatenginxapache
Author
REXE Teknoloji Network & Security Team
Editor
REXE Teknoloji Technical Editorial
First published
Last updated

SSL/TLS Certificate Setup: Let's Encrypt Complete Guide

SSL/TLS certificates encrypt communication between your web server and visitors. HTTPS is now essential for SEO rankings, browser trust indicators, and user security. Let's Encrypt provides free, automated, and open-source certificates trusted by all major browsers.

What is SSL/TLS?

SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are cryptographic protocols that secure data transmitted over networks. When a website uses HTTPS:

  • Data is encrypted in transit (confidentiality)
  • Server identity is verified (authentication)
  • Data cannot be tampered with (integrity)

Modern browsers mark HTTP sites as "Not Secure". Google uses HTTPS as a ranking signal. On REXE servers, SSL installation is free and straightforward.

Installing Certbot

Certbot is the official tool that automatically obtains and renews Let's Encrypt certificates.

Debian/Ubuntu

hljs bash
# Update system
sudo apt update && sudo apt upgrade -y

# Install Certbot with Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

# For Apache
sudo apt install certbot python3-certbot-apache -y

RHEL/CentOS/AlmaLinux

hljs bash
# Add EPEL repository
sudo dnf install epel-release -y

# Install Certbot
sudo dnf install certbot python3-certbot-nginx -y

Install via Snap (Recommended)

hljs bash
# Install snapd
sudo apt install snapd -y

# Install Certbot via snap
sudo snap install --classic certbot

# Create symlink
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Verify installation
certbot --version

Obtaining SSL Certificate for Nginx

Prerequisites

Before obtaining a certificate:

  1. Your domain must point to your server's IP address
  2. Ports 80 and 443 must be open
  3. Nginx must be running
hljs bash
# Check domain resolution
nslookup example.com

# Check firewall status
sudo ufw status
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Automatic Nginx Configuration

hljs bash
# Obtain certificate and auto-configure Nginx
sudo certbot --nginx -d example.com -d www.example.com

# Obtain certificate only (configure manually)
sudo certbot certonly --nginx -d example.com -d www.example.com

# Wildcard certificate (requires DNS challenge)
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

Certbot will prompt for your email and HTTPS redirect preference:

Enter email address: admin@example.com
Agree to terms: Y
Share email with EFF: N
Redirect HTTP to HTTPS: 2 (Redirect)

Manual Nginx SSL Configuration

hljs bash
# Edit Nginx virtual host
sudo nano /etc/nginx/sites-available/example.com
hljs nginx
# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# HTTPS server block
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    # Let's Encrypt certificate files
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Secure SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # HSTS (6 months)
    add_header Strict-Transport-Security "max-age=15768000" always;

    root /var/www/example.com/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}
hljs bash
# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Obtaining SSL Certificate for Apache

hljs bash
# Enable SSL module
sudo a2enmod ssl
sudo a2enmod rewrite

# Obtain certificate with Apache plugin
sudo certbot --apache -d example.com -d www.example.com

# Certificate only
sudo certbot certonly --apache -d example.com

Manual Apache SSL Configuration

hljs apache
<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

    Header always set Strict-Transport-Security "max-age=15768000"
</VirtualHost>

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Auto-Renewal

Let's Encrypt certificates are valid for 90 days. Certbot sets up a systemd timer or cron job for automatic renewal.

hljs bash
# Test auto-renewal
sudo certbot renew --dry-run

# Check timer status
sudo systemctl status certbot.timer

# Manual renewal
sudo certbot renew

# Reload Nginx after renewal
sudo certbot renew --post-hook "systemctl reload nginx"

Cron-based Auto-Renewal

hljs bash
# Edit crontab
sudo crontab -e

# Check twice daily (Let's Encrypt recommendation)
0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

Checking Certificate Status

hljs bash
# List all certificates
sudo certbot certificates

# Check certificate expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Test SSL configuration
curl -vI https://example.com 2>&1 | grep -E "SSL|TLS|certificate"

Troubleshooting

Port 80 Blocked Error

hljs bash
# Open firewall ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Also open ports in REXE Path Panel
# Check Nginx is running
sudo systemctl status nginx

Domain Resolution Error

hljs bash
# Check DNS propagation
nslookup example.com 8.8.8.8
dig example.com +short

# Verify server IP
curl -4 ifconfig.me

Certificate Renewal Failure

hljs bash
# Renew with verbose output
sudo certbot renew --dry-run -v

# Check logs
sudo tail -f /var/log/letsencrypt/letsencrypt.log

Let's Encrypt enforces rate limits: 5 failed attempts per hour. Use the --staging flag for testing to avoid hitting limits.

hljs bash
# Test with staging environment (no rate limits)
sudo certbot --nginx --staging -d example.com

Conclusion

With Let's Encrypt and Certbot, SSL/TLS certificate installation takes just minutes. Automatic renewal eliminates certificate expiry concerns. Using HTTPS on REXE servers is critical for both security and SEO performance.

Frequently Asked Questions

Is Let's Encrypt really free?

Yes, Let's Encrypt is completely free. Certificates are valid for 90 days and automatically renewed by Certbot. The only difference from commercial certificates is that it doesn't offer Organization Validation (OV) or Extended Validation (EV).

How do I get a wildcard certificate?

Wildcard certificates (*.example.com) require DNS validation: 'sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com"'. Certbot provides a TXT record value that you add to your DNS manager, then verification completes.

When does the certificate renew?

Certbot renews certificates 30 days before expiry. It checks twice daily via systemd timer or cron job. Run 'sudo certbot renew --dry-run' to test the renewal process without making changes.

Can I get one certificate for multiple domains?

Yes, using SAN (Subject Alternative Names): 'sudo certbot --nginx -d example.com -d www.example.com -d api.example.com'. A single certificate can cover up to 100 domains.

Site still shows HTTP after SSL installation, why?

Clear your browser cache. Ensure HTTP to HTTPS redirect (301) is configured in Nginx/Apache. Run 'sudo nginx -t && sudo systemctl reload nginx' to apply configuration changes.

Related Articles

Network TrafficInbound— GbpsOutbound— Gbps