How to Install Let’s Encrypt SSL on Nginx/Apache + Auto-Renew (Without Common Errors)
HTTPS is no longer “nice to have.” It’s the default expectation for modern websites—and failing to use it can hurt trust, SEO, and security. The good news: Let’s Encrypt provides free SSL/TLS certificates, and with the right setup you can enable HTTPS on a VPS in a predictable, low-risk way.
This guide shows how to install Let’s Encrypt SSL using Certbot on Nginx or Apache, generate certificates for your root domain +
www
+ subdomains, force HTTP → HTTPS redirects, configure auto-renew, test renewals safely, and troubleshoot the most common errors (NXDOMAIN, challenge failures, port 80 blocked, and rate limits). It’s written to help beginners avoid the usual pitfalls.1) Why HTTPS Is Mandatory (SEO, Security, Browser Warnings)
Security (Encryption + Integrity)
HTTPS encrypts traffic between the visitor and your server. This protects:
login credentials
form submissions
cookies/sessions
API requests
any user data moving across the network
It also ensures the content isn’t modified in transit (integrity).
SEO and performance benefits
Search engines treat HTTPS as a standard quality signal. While HTTPS alone won’t guarantee rankings, it removes a negative factor and often improves user behavior metrics (bounce rate, conversion), which indirectly helps.
Browser trust and warnings
Browsers increasingly label HTTP pages as Not Secure, especially if forms or inputs are present. This can reduce user confidence and increase abandonment.
2) Requirements Before You Install SSL (Most Important Step)
Let’s Encrypt must verify you control the domain. The most common verification method is the HTTP-01 challenge, which requires:
A domain name (example:
example.com
)DNS records pointing to your server IP:
A
record: example.com → YOUR_VPS_IP
A
or CNAME
record: www.example.com → YOUR_VPS_IP
or → example.com
For subdomains:
api.example.com
, app.example.com
, etc. should also point correctlyYour web server must be reachable on:
Port 80 (HTTP) for validation
Port 443 (HTTPS) for actual secure traffic after installation
Your VPS firewall/security group must allow inbound:
80/tcp
, 443/tcp
plus SSH (typically
22/tcp
or your custom port)Quick pre-checks (highly recommended)
From your local computer:
Check DNS resolves:
nslookup example.com
nslookup www.example.com
Verify your site loads over HTTP first:
http://example.com
http://www.example.com
If HTTP is not working, fix DNS and web server first—SSL setup will fail until it’s reachable.
3) Install Certbot + Correct Plugin (Ubuntu/Debian)
Certbot is the standard tool used to request and renew Let’s Encrypt certificates.
A) For Nginx
sudo apt update
sudo apt install -y certbot python3-certbot-nginx
B) For Apache
sudo apt update
sudo apt install -y certbot python3-certbot-apache
Confirm Certbot is installed
certbot --version
4) Generate SSL for Root Domain + WWW + Subdomains
You can request a certificate for multiple hostnames in one command. This is common and practical.
A) Nginx: issue + configure automatically
Example for root + www:
sudo certbot --nginx -d example.com -d www.example.com
Example including subdomains:
sudo certbot --nginx \
-d example.com \
-d www.example.com \
-d api.example.com \
-d app.example.com
Certbot will:
verify your domain ownership (via HTTP challenge)
create certificate files
modify Nginx config automatically (if it can)
reload Nginx
B) Apache: issue + configure automatically
sudo certbot --apache -d example.com -d www.example.com
With subdomains:
sudo certbot --apache \
-d example.com \
-d www.example.com \
-d api.example.com \
-d app.example.com
What if you have many subdomains?
You can also use a wildcard certificate like
*.example.com
, but that typically requires DNS-01 challenge (changing DNS TXT records). It’s powerful, but more advanced. For beginners, starting with explicit -d
hostnames is simpler and less error-prone.5) Redirect HTTP → HTTPS (Recommended for Nearly All Sites)
Redirecting HTTP to HTTPS ensures every visitor ends up on the secure version.
Option A (Recommended): Let Certbot set the redirect
During the Certbot process, you’ll often be asked:
“Redirect HTTP traffic to HTTPS?”
Choose Yes. This is usually the easiest.
Option B: Manual redirect (Nginx)
Add or confirm this server block exists for port 80:
server {
listen 80;
server_name example.com www.example.com;
return 301 https://$host$request_uri;
}
Then reload:
sudo nginx -t
sudo systemctl reload nginx
Option C: Manual redirect (Apache)
In your port 80 VirtualHost:
<VirtualHost *:80>
ServerName example.com
ServerAlias www.example.com
Redirect permanent / https://example.com/
</VirtualHost>
Reload:
sudo systemctl reload apache2
Tip: Choose a “canonical” hostname
Decide whether your primary domain should be:
https://example.com
(most common)or
https://www.example.com
Then redirect the other to the canonical version to avoid SEO duplicate-content signals.
6) Auto-Renew: Make Sure It Renews Before Expiration
Let’s Encrypt certificates typically last 90 days, but renewal is automated.
A) Check renewal timer/service
On many Ubuntu systems, Certbot sets up a systemd timer automatically.
Check:
systemctl list-timers | grep certbot
B) Test renewal safely (dry run)
This is the best way to confirm auto-renew will work:
sudo certbot renew --dry-run
If this succeeds, your renewal process is correctly configured.
C) Verify certificate expiration date
sudo certbot certificates
You’ll see installed certificates and their expiry dates.
7) Troubleshooting Common Errors (and How to Fix Them)
Below are the issues that cause most SSL failures.
Error 1: NXDOMAIN (domain does not exist)
Symptoms
Certbot says:
NXDOMAIN looking up A for example.com
Verification fails immediately
Cause
DNS record is missing or misconfigured
Nameservers not set correctly at the registrar
Fix
Confirm you’re editing DNS in the correct provider (authoritative nameserver).
Ensure
A
record exists:example.com → YOUR_VPS_IP
Wait for propagation (sometimes minutes, sometimes longer depending on TTL).
Re-test:
nslookup example.com
dig example.com A
Error 2: Challenge failed (HTTP-01 validation failed)
Symptoms
Certbot shows: “Invalid response” or “Timeout during connect”
Let’s Encrypt can’t fetch the verification file
Most common causes
Port 80 blocked by firewall / security group
Nginx/Apache not running
DNS points to the wrong IP
Another service is using port 80
CDN/proxy mode interfering (for example, incorrect SSL mode on Cloudflare)
Fix checklist
Confirm DNS points to your VPS IP:
dig example.com A
Confirm ports are open:
sudo ufw status
Ensure
80/tcp
and 443/tcp
are allowedConfirm web server listens on 80:
sudo ss -tulpn | grep :80
Confirm HTTP works from outside:
open
http://example.com
in a browserIf using Cloudflare:
temporarily set record to DNS only while issuing the certificate, or ensure Cloudflare SSL mode is compatible (often “Full” or “Full (strict)” is needed after cert is installed).
Error 3: Port 80 is closed (but I only want HTTPS)
This is a very common misunderstanding: the HTTP-01 challenge requires port 80 at least during issuance/renewal (unless you use DNS-01).
Fix
Open port 80 temporarily (or permanently with redirect):
sudo ufw allow 80/tcp
Keep port 80 open and redirect to HTTPS. This is standard and safe.
Error 4: Rate limit (too many failed attempts)
Let’s Encrypt has rate limits to prevent abuse. If you request/failed repeatedly, you may hit:
failed validation limits
duplicate certificate limits
Fix
Stop retrying blindly—identify the underlying issue first (DNS, port 80, wrong IP).
Use Certbot’s
--dry-run
for renew tests (safe).If you’re testing new setups frequently, consider using Let’s Encrypt staging to avoid production rate limits:
sudo certbot --nginx --staging -d example.com -d www.example.com
Staging certificates are not trusted by browsers, but great for troubleshooting.
Error 5: “Could not bind to port 80” / port conflict
Symptoms
Certbot fails because something else is using port 80
Causes
Apache and Nginx both installed and both trying to bind 80
Another service is listening on 80
Fix
Identify what uses port 80:
sudo ss -tulpn | grep :80
Stop/disable the conflicting service.
Run Certbot again.
8) HSTS (Optional): What It Is and When It’s Safe
HSTS (HTTP Strict Transport Security) tells browsers:
“Always use HTTPS for this domain.”
This improves security but can cause problems if you misconfigure HTTPS later.
When HSTS is safe to enable
Enable HSTS only when:
HTTPS is stable and working correctly
you are confident you will keep HTTPS enabled permanently
your subdomains are also HTTPS-ready (if you use
includeSubDomains
)A cautious HSTS approach (recommended)
Start with a small max-age (e.g., 1 day), test, then increase.
Example Nginx header:
add_header Strict-Transport-Security "max-age=86400" always;
After confirming everything is stable, you can increase to weeks/months.
Avoid enabling “preload” unless you fully understand the implications and are certain you want permanent HTTPS enforcement (including subdomains).
9) Final Verification Checklist (No Surprises)
After installation:
HTTP redirects to HTTPS:
curl -I http://example.com
should show 301
and Location: https://...
HTTPS works:
curl -I https://example.com
should return 200
/301
without certificate errorsCertbot renewal works:
sudo certbot renew --dry-run
Firewall is correct:
inbound open: 80, 443, SSH
no unnecessary ports exposed
Conclusion
Installing Let’s Encrypt SSL on a VPS is straightforward when the fundamentals are correct:
Make sure DNS points to your server
Ensure port 80 is reachable (for HTTP-01 challenge)
Install Certbot + the right plugin (Nginx/Apache)
Generate certificates for root + www + subdomains
Redirect HTTP → HTTPS
Confirm auto-renew with a dry run
Troubleshoot systematically (NXDOMAIN, closed port 80, wrong IP, rate limits)
Once set up properly, Let’s Encrypt becomes a “set it and forget it” part of your infrastructure—keeping your site secure and trusted without ongoing manual work.
Komentar
Posting Komentar