SSL/TLS Certificate Setup: Let's Encrypt Complete Guide

SSL/TLS certificates encrypt communication between your web server and visitors. HTTPS is now essential for SEO rankings, browser trust indicators, and user security. Let's Encrypt provides free, automated, and open-source certificates trusted by all major browsers.

What is SSL/TLS?

SSL (Secure Sockets Layer) and its modern successor TLS (Transport Layer Security) are cryptographic protocols that secure data transmitted over networks. When a website uses HTTPS:

Data is encrypted in transit (confidentiality)
Server identity is verified (authentication)
Data cannot be tampered with (integrity)

Modern browsers mark HTTP sites as "Not Secure". Google uses HTTPS as a ranking signal. On REXE servers, SSL installation is free and straightforward.

Installing Certbot

Certbot is the official tool that automatically obtains and renews Let's Encrypt certificates.

Debian/Ubuntu

hljs bash

# Update system
sudo apt update && sudo apt upgrade -y

# Install Certbot with Nginx plugin
sudo apt install certbot python3-certbot-nginx -y

# For Apache
sudo apt install certbot python3-certbot-apache -y

RHEL/CentOS/AlmaLinux

hljs bash

# Add EPEL repository
sudo dnf install epel-release -y

# Install Certbot
sudo dnf install certbot python3-certbot-nginx -y

Install via Snap (Recommended)

hljs bash

# Install snapd
sudo apt install snapd -y

# Install Certbot via snap
sudo snap install --classic certbot

# Create symlink
sudo ln -s /snap/bin/certbot /usr/bin/certbot

# Verify installation
certbot --version

Obtaining SSL Certificate for Nginx

Prerequisites

Before obtaining a certificate:

Your domain must point to your server's IP address
Ports 80 and 443 must be open
Nginx must be running

hljs bash

# Check domain resolution
nslookup example.com

# Check firewall status
sudo ufw status
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Automatic Nginx Configuration

hljs bash

# Obtain certificate and auto-configure Nginx
sudo certbot --nginx -d example.com -d www.example.com

# Obtain certificate only (configure manually)
sudo certbot certonly --nginx -d example.com -d www.example.com

# Wildcard certificate (requires DNS challenge)
sudo certbot certonly --manual --preferred-challenges dns -d "*.example.com" -d example.com

Certbot will prompt for your email and HTTPS redirect preference:

Enter email address: admin@example.com
Agree to terms: Y
Share email with EFF: N
Redirect HTTP to HTTPS: 2 (Redirect)

Manual Nginx SSL Configuration

hljs bash

# Edit Nginx virtual host
sudo nano /etc/nginx/sites-available/example.com

hljs nginx

# Redirect HTTP to HTTPS
server {
    listen 80;
    server_name example.com www.example.com;
    return 301 https://$server_name$request_uri;
}

# HTTPS server block
server {
    listen 443 ssl http2;
    server_name example.com www.example.com;

    # Let's Encrypt certificate files
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

    # Secure SSL settings
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256;
    ssl_prefer_server_ciphers off;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 1d;

    # HSTS (6 months)
    add_header Strict-Transport-Security "max-age=15768000" always;

    root /var/www/example.com/html;
    index index.html index.php;

    location / {
        try_files $uri $uri/ =404;
    }
}

hljs bash

# Test configuration
sudo nginx -t

# Reload Nginx
sudo systemctl reload nginx

Obtaining SSL Certificate for Apache

hljs bash

# Enable SSL module
sudo a2enmod ssl
sudo a2enmod rewrite

# Obtain certificate with Apache plugin
sudo certbot --apache -d example.com -d www.example.com

# Certificate only
sudo certbot certonly --apache -d example.com

Manual Apache SSL Configuration

hljs apache

<VirtualHost *:443>
    ServerName example.com
    ServerAlias www.example.com
    DocumentRoot /var/www/example.com

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/example.com/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/example.com/privkey.pem

    SSLProtocol all -SSLv3 -TLSv1 -TLSv1.1
    SSLCipherSuite ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256

    Header always set Strict-Transport-Security "max-age=15768000"
</VirtualHost>

<VirtualHost *:80>
    ServerName example.com
    Redirect permanent / https://example.com/
</VirtualHost>

Auto-Renewal

Let's Encrypt certificates are valid for 90 days. Certbot sets up a systemd timer or cron job for automatic renewal.

hljs bash

# Test auto-renewal
sudo certbot renew --dry-run

# Check timer status
sudo systemctl status certbot.timer

# Manual renewal
sudo certbot renew

# Reload Nginx after renewal
sudo certbot renew --post-hook "systemctl reload nginx"

Cron-based Auto-Renewal

hljs bash

# Edit crontab
sudo crontab -e

# Check twice daily (Let's Encrypt recommendation)
0 0,12 * * * certbot renew --quiet --post-hook "systemctl reload nginx"

Checking Certificate Status

hljs bash

# List all certificates
sudo certbot certificates

# Check certificate expiry date
echo | openssl s_client -connect example.com:443 2>/dev/null | openssl x509 -noout -dates

# Test SSL configuration
curl -vI https://example.com 2>&1 | grep -E "SSL|TLS|certificate"

Troubleshooting

Port 80 Blocked Error

hljs bash

# Open firewall ports
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Also open ports in REXE Path Panel
# Check Nginx is running
sudo systemctl status nginx

Domain Resolution Error

hljs bash

# Check DNS propagation
nslookup example.com 8.8.8.8
dig example.com +short

# Verify server IP
curl -4 ifconfig.me

Certificate Renewal Failure

hljs bash

# Renew with verbose output
sudo certbot renew --dry-run -v

# Check logs
sudo tail -f /var/log/letsencrypt/letsencrypt.log

Let's Encrypt enforces rate limits: 5 failed attempts per hour. Use the --staging flag for testing to avoid hitting limits.

hljs bash

# Test with staging environment (no rate limits)
sudo certbot --nginx --staging -d example.com

Conclusion

With Let's Encrypt and Certbot, SSL/TLS certificate installation takes just minutes. Automatic renewal eliminates certificate expiry concerns. Using HTTPS on REXE servers is critical for both security and SEO performance.

SSL/TLS Certificate Setup: Let's Encrypt Complete Guide

Table of Contents