How to Install Let's Encrypt SSL on Ubuntu Server

Securing your website with SSL/TLS (Secure Sockets Layer / Transport Layer Security) encryption is essential for every modern web application. SSL encrypts all traffic between your visitors’ web browsers and your server, protecting sensitive user information, passwords, and payment data from interception, improving your search engine rankings on Google, and eliminating the dreaded "Not Secure" browser warning.

Let’s Encrypt is a free, automated, and open Certificate Authority (CA) that provides trusted SSL certificates recognized by all major browsers. Using Certbot—the official Electronic Frontier Foundation (EFF) tool—you can automatically obtain, install, and configure SSL certificates on Ubuntu 26.04 LTS, Ubuntu 24.04 LTS, Ubuntu 22.04 LTS, and Ubuntu 20.04 LTS with zero manual renewal hassle.

In this comprehensive, beginner-friendly guide, we will walk you through installing Let’s Encrypt SSL on an Ubuntu server running Nginx or Apache, testing automatic renewals, and verifying your HTTPS security.

Prerequisites

• An active Linux Virtual Private Server (VPS) running Ubuntu (20.04, 22.04, 24.04, or 26.04 LTS).
• SSH access with sudo or root privileges.
• Nginx or Apache web server installed and active (see our guide on How to Set Up Nginx on Ubuntu Server).
• A registered domain name (e.g. domain.com and www.domain.com) with DNS A Records pointing directly to your VPS server’s public IP address (refer to How to Point Your Domain to a VPS IP Address).
• Ports 80 (HTTP) and 443 (HTTPS) open in your UFW firewall.

Step-by-Step Guide: How to Install Let’s Encrypt SSL on Ubuntu

Step 1: Verify Domain DNS and Web Server Configuration

1. Ensure your domain name points to your VPS IP. You can verify this in your terminal:

   ping -c 2 domain.com
   ping -c 2 www.domain.com

2. Verify that your Nginx server block (in /etc/nginx/sites-available/domain.com) or Apache virtual host contains your domain names in the server_name directive:

   server_name domain.com www.domain.com;

Step 2: Update System Packages and Install Snapd

The Electronic Frontier Foundation (EFF) officially recommends installing Certbot via Snap to ensure you always receive the latest security patches and features regardless of your Ubuntu release version.

1. Update your system repositories:

   sudo apt update

2. Ensure snapd is installed and up to date:

   sudo apt install snapd -y
   sudo snap install core && sudo snap refresh core

Step 3: Remove Outdated Certbot & Install Latest Certbot via Snap

1. Remove any old OS-packaged versions of Certbot to prevent conflicts:

   sudo apt remove certbot -y

2. Install the official Certbot package with classic confinement:

   sudo snap install --classic certbot

3. Create a symbolic link so you can run the certbot command directly from any directory:

   sudo ln -s /snap/bin/certbot /usr/bin/certbot

4. Verify the installation:

   certbot --version

Step 4: Allow HTTPS Traffic in UFW Firewall

Ensure that both HTTP (port 80) and HTTPS (port 443) traffic are permitted through your firewall:

# For Nginx:
sudo ufw allow 'Nginx Full'

# For Apache:
sudo ufw allow 'Apache Full'

# Check status:
sudo ufw status

Step 5: Obtain and Install the SSL Certificate

Option A: For Nginx Web Server (Recommended)

Run Certbot with the --nginx plugin to automatically obtain certificates and configure your Nginx server block:

sudo certbot --nginx -d domain.com -d www.domain.com

Option B: For Apache Web Server

Run Certbot with the --apache plugin:

sudo certbot --apache -d domain.com -d www.domain.com

Interactive Configuration Prompts Explained:

• Email Address: Enter your valid email address (used by Let’s Encrypt for urgent renewal notifications and security alerts).
• Terms of Service: Type Y and press ENTER to agree to the Let’s Encrypt Subscriber Agreement.
• EFF Newsletter: Type N or Y to choose whether to share your email with the Electronic Frontier Foundation.
• HTTPS Redirection: Certbot will ask if you want to automatically redirect all HTTP traffic to HTTPS. Choose Redirect (Option 2) for maximum security.

Once complete, Certbot will output a success message showing the location of your certificate files:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/domain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/domain.com/privkey.pem
Congratulations! You have successfully enabled HTTPS on https://domain.com and https://www.domain.com

Step 6: Test Automatic SSL Renewal

Let’s Encrypt certificates are valid for 90 days. Certbot automatically creates a background systemd timer (or cron job) that runs twice daily to automatically renew any certificate expiring within 30 days.

1. Test the renewal process with a dry run to verify everything works seamlessly:

   sudo certbot renew --dry-run

   If you see "Congratulations, all simulated renewals succeeded", your automatic renewal is configured perfectly.

2. Verify the active Certbot systemd timer:

   sudo systemctl status snap.certbot.renew.service

Step 7: Verify HTTPS in Your Web Browser

1. Open your web browser and navigate to https://domain.com.
2. Click on the padlock icon in the address bar to view your SSL certificate details, issuer (Let's Encrypt Authority), and encryption cipher.
3. You can also run an in-depth security test via Qualys SSL Labs to confirm an A+ Grade rating.

Certificate File Locations Reference

Frequently Asked Questions & Troubleshooting

Q: Why does Certbot fail with "Problem binding to port 80" or "Connection refused"?
A: This error typically means that port 80 is blocked by a firewall or that your DNS A Record is not pointing to the correct VPS IP. Ensure your UFW firewall allows HTTP traffic (sudo ufw allow 80/tcp) and that DNS propagation is complete.

Q: How can I manually trigger a certificate renewal?
A: Run sudo certbot renew. Certbot will check all installed certificates and renew those that are close to expiring.

Q: What if I am using Docker or Node.js without Nginx/Apache?
A: You can use Certbot in standalone mode: sudo certbot certonly --standalone -d domain.com, or configure Nginx as a reverse proxy in front of your Node.js/Docker container.

Need Further Assistance?

If you encounter any issues obtaining or renewing Let’s Encrypt SSL certificates on your Ubuntu VPS, our technical support team is available 24/7. Feel free to submit a support ticket through your client area for fast, expert guidance.