Secure Nginx With Let's Encrypt on Ubuntu 24.04 and 22.04 (Free HTTPS)

Let's Encrypt gives you free HTTPS certificates that renew automatically. Certbot gets the certificate, edits your Nginx config and sets up renewal in a few commands.

Related guide: Full Let's Encrypt guide: wildcards, DNS challenge and troubleshooting

1. Install Certbot

The Ubuntu package works well on 24.04 and 22.04. Certbot's own recommended method is the snap (sudo snap install –classic certbot).

sudo apt update
sudo apt install certbot python3-certbot-nginx

2. Check your Nginx server block

Your site's server_name must list the domain names you want on the certificate, and DNS for them must point at this server.

grep -R server_name /etc/nginx/sites-enabled/
sudo nginx -t

3. Allow HTTPS through the firewall

If UFW is on, allow both HTTP and HTTPS. Port 80 must stay open for the HTTP challenge and renewals.

sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'

4. Get the certificate

Certbot verifies the domain, installs the certificate and can add the HTTP to HTTPS redirect for you.

sudo certbot --nginx -d example.com -d www.example.com

5. Test automatic renewal

Certificates last 90 days and renew automatically about 30 days before expiry. A dry run proves renewal works.

sudo certbot renew --dry-run
systemctl list-timers | grep certbot

FAQ

Is Let's Encrypt really free for commercial sites?

Yes. Let's Encrypt is a free, nonprofit certificate authority and its certificates are trusted by all major browsers.

Certbot says the challenge failed. What do I check?

That DNS for the domain points to this server, port 80 is open in the firewall and at your hosting provider, and nginx -t passes.