How to Install Let's Encrypt SSL on Linux VPS

Securing your websites, web applications, and APIs with HTTPS (SSL/TLS encryption) is mandatory for protecting user privacy, encrypting sensitive data, and achieving top search engine rankings. Let’s Encrypt is a globally trusted, non-profit Certificate Authority (CA) that provides automated, industry-standard SSL certificates at zero cost.

Using Certbot – the official Let’s Encrypt client developed by the Electronic Frontier Foundation (EFF) – you can issue and configure automated SSL certificates on any Linux distribution in under 3 minutes.

In this comprehensive guide, we will walk you through installing Let’s Encrypt SSL on Ubuntu, Debian, AlmaLinux, Rocky Linux, RHEL, and CentOS with automated certificate renewal.

Prerequisites

• An active Linux Virtual Private Server (VPS) running Ubuntu, Debian, AlmaLinux, Rocky Linux, or CentOS.
• SSH access with sudo or root privileges (see How to Log in and Access Linux VPS via SSH).
• A registered domain name pointing its A Record to your Linux VPS IP address (see How to Point Your Domain to a VPS IP Address).
• Nginx or Apache web server installed and active (see How to Set Up Nginx on Linux VPS).
• Firewall ports 80 (HTTP) and 443 (HTTPS) open and accessible.
• Looking for a Wildcard SSL certificate? See How to Install Wildcard Let's Encrypt SSL on Linux VPS.

Step 1: Install Certbot on Your Linux Distribution

Option A: Ubuntu & Debian (Snapd Recommended)

# Update package repositories
sudo apt update

# Install Snapd and Certbot
sudo apt install snapd -y
sudo snap install core && sudo snap refresh core
sudo snap install --classic certbot

# Create symlink to global path
sudo ln -s /snap/bin/certbot /usr/bin/certbot

Option B: AlmaLinux, Rocky Linux & RHEL (EPEL & DNF)

# Enable EPEL and PowerTools / CRB repository
sudo dnf install epel-release -y
sudo dnf config-manager --set-enabled crb || sudo dnf config-manager --set-enabled powertools

# For Nginx:
sudo dnf install certbot python3-certbot-nginx -y

# For Apache:
sudo dnf install certbot python3-certbot-apache -y

Step 2: Obtain and Install the SSL Certificate

For Nginx Web Server:

Run the automated Certbot Nginx plugin (replace domain.com and www.domain.com with your actual domain):

sudo certbot --nginx -d domain.com -d www.domain.com

For Apache Web Server:

sudo certbot --apache -d domain.com -d www.domain.com

Interactive Prompts:

1. Email Address: Enter your email address to receive urgent security and renewal alerts.
2. Terms of Service: Type Y and press ENTER to agree to Let’s Encrypt terms.
3. EFF Newsletter: Type N (or Y) to skip promotional emails.
4. HTTPS Redirection: Select 2 (Redirect) to automatically redirect all incoming unencrypted HTTP requests to secure HTTPS.

Certbot will validate domain ownership, download the SSL certificates, configure your web server blocks, and reload your web server automatically:

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/domain.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/domain.com/privkey.pem
Congratulations! You have successfully enabled HTTPS on https://domain.com

Step 3: Test and Verify Automated SSL Renewal

Let’s Encrypt certificates are valid for 90 days. Certbot installs a background systemd timer (certbot.timer or snap.certbot.renew.timer) that automatically checks and renews certificates within 30 days of expiry.

Verify that automated renewal is working properly with a dry-run test:

sudo certbot renew --dry-run

If the simulation succeeds without errors, your server is completely set up for automatic, maintenance-free SSL renewals!

Step 4: Check Automated Renewal Systemd Timers

You can check the active status of the automated renewal service at any time:

sudo systemctl list-timers | grep certbot

Frequently Asked Questions & Troubleshooting

Q: Why does Certbot fail with "Problem binding to port 80: Could not bind to IPv4 or IPv6"?
A: This occurs if another service is already using port 80 or if your web server configuration has syntax errors. Test your Nginx/Apache configuration first with sudo nginx -t or sudo apachectl configtest.

Q: How do I verify my SSL certificate quality and grade?
A: Visit Qualys SSL Labs (ssllabs.com/ssltest/), enter your domain, and verify that your Linux VPS achieves an A+ Grade.

Need Further Assistance?

If you encounter domain verification issues, firewall blocks, or SSL configuration errors on your Linux VPS, our technical support team is available 24/7. Feel free to submit a support ticket for prompt assistance.