Setting Up Let's Encrypt SSL on a Linux Server

Setting Up Let's Encrypt with Certbot

Let's Encrypt is a free, automated Certificate Authority that provides DV certificates. Certbot is the official client for obtaining and renewing certificates.

Prerequisites

• A Linux server (Ubuntu/Debian or CentOS/RHEL)

• A domain name pointing to your server's IP address

• Apache or Nginx installed and serving your PHP application

• Root or sudo access

Step 1: Install Certbot

Ubuntu/Debian with Nginx:

sudo apt update
sudo apt install certbot python3-certbot-nginx

Ubuntu/Debian with Apache:

sudo apt update
sudo apt install certbot python3-certbot-apache

Step 2: Obtain a Certificate

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Certbot will:
1. Verify you control the domain
2. Obtain the certificate
3. Automatically configure your web server
4. Set up HTTPS redirects (if you choose)

Step 3: Verify Auto-Renewal

Let's Encrypt certificates expire every 90 days. Certbot installs a cron job or systemd timer automatically:

sudo certbot renew --dry-run

If the dry run succeeds, your certificates will renew automatically.

Step 4: Verify Your Configuration

Check that your site is accessible via HTTPS:

curl -I https://yourdomain.com

You should see HTTP/2 200 and security headers in the response.

Nginx SSL Configuration Block

Certbot modifies your Nginx config, but here is what it looks like:

server {
    listen 443 ssl http2;
    server_name yourdomain.com;
    ssl_certificate /etc/letsencrypt/live/yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/yourdomain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    root /var/www/yourdomain.com;
    index index.php;
}

Common Issues

• Port 80/443 blocked: Ensure your firewall allows HTTP and HTTPS traffic

• DNS not propagated: Wait for DNS changes to propagate before running Certbot

• Rate limits: Let's Encrypt has rate limits — use --staging flag for testing