Skip to main content
HTTPS is table stakes. Let’s Encrypt issues free certificates, and Certbot automates the whole flow: request the cert, install it in Nginx, and renew it automatically before it expires.

​
Prerequisites

  • A domain name pointing to your VPS. See Custom Domain.
  • Nginx installed and serving your site. See Web Server.
  • Ports 80 and 443 open in your firewall. See Firewall.

​
Install Certbot

​
Issue a certificate

Certbot can edit your Nginx config automatically and set up HTTPS in one step.
You will be asked for an email (for renewal reminders) and whether to redirect all HTTP traffic to HTTPS. Yes is the right answer for most sites.

​
Test automatic renewal

Certbot installs a systemd timer that renews certificates before they expire. Verify it works with a dry run:
If that succeeds, you never need to touch renewal again.

​
Check certificate status

​
Revoke or delete a certificate

If Certbot fails with a challenge error, the most common cause is DNS not yet pointing to your VPS or port 80 being blocked. Confirm both before retrying.
Let’s Encrypt has rate limits (currently 5 duplicate certificates per week per domain). Use --dry-run when testing to avoid hitting the limit.