Skip to content
// WEB (SERVER) | July 9, 2026 | 3 min read

Install Let’s Encrypt SSL on Nginx

Free, trusted SSL for your nginx site, and it renews itself so you never think about it again.

Install Let’s Encrypt SSL on Nginx
H
Hanna Taoufik The Hostner team writes about servers, Linux, security, and everything that comes with running your own infrastructure, so you can skip the support ticket.
user@server:~
user@server ~ $ uptime && df -h / | tail -1
14:22:37 up 847 days, load: 0.08
/dev/sda1 1.8T 420G 1.3T 25% /
user@server ~ $ free -h
total used free
Mem: 32Gi 4.2Gi 27Gi
user@server ~ $

Here is how to install Let’s Encrypt SSL on Nginx. This guide uses Certbot, the tool the Electronic Frontier Foundation built and maintains specifically for this, and it works the same way across AlmaLinux, Debian, and Ubuntu, since Certbot ships as a snap package that is not tied to any one distro’s package manager. Without a certificate, browsers flag your site as “Not Secure”, and that warning alone is enough to make visitors leave before they even see your content.

What you need

  • A Hostner dedicated server running Linux with nginx installed
  • Root or sudo access via SSH
  • A domain name pointed at your server’s IP address
  • A site already configured in nginx under that domain, reachable over plain HTTP on port 80

Step 1: Install Certbot

If snapd is not already installed, add it first. On Debian or Ubuntu:

~ $ sudo apt install snapd

On AlmaLinux:

~ $ sudo dnf install snapd ~ $ sudo systemctl enable –now snapd.socket ~ $ sudo ln -s /var/lib/snapd/snap /snap

Then install Certbot itself, the same command regardless of distro:

~ $ sudo snap install –classic certbot ~ $ sudo ln -s /snap/bin/certbot /usr/bin/certbot

Step 2: Install Let’s Encrypt SSL on Nginx

Run Certbot with the nginx plugin, which edits your nginx config and reloads it automatically:

~ $ sudo certbot –nginx

Certbot detects the domains configured in your existing nginx server blocks and asks which one you want a certificate for. Select it, then enter an email address when prompted, this is only used if Let’s Encrypt needs to reach you about a renewal issue. Type A to agree to the terms of service.

Step 3: Confirm the certificate

Certbot verifies domain ownership over HTTP automatically and, once that succeeds, installs the certificate and updates your nginx configuration to use it. It also asks whether you want to redirect all HTTP traffic to HTTPS, choosing yes here is generally the safer option.

Open a browser and visit your site with https:// instead of http://. You should see a padlock icon with no warning. If a warning still shows up, clear your browser cache before assuming the certificate itself is the problem, an old cached page can hide a successful install.

Step 4: Verify auto-renewal

Certbot sets up a scheduled task to renew the certificate automatically before it expires (Let’s Encrypt certificates last 90 days). Confirm the timer is active:

~ $ sudo systemctl status snap.certbot.renew.timer

You can also test the renewal process without actually renewing anything yet:

~ $ sudo certbot renew –dry-run

If it does not work

If domain verification fails, the most common cause is port 80 not being reachable from the internet, Let’s Encrypt needs that port open to confirm you control the domain. Check your firewall rules first. A domain that does not yet resolve to this server, or resolves to the wrong IP, produces the exact same failure, so verify DNS before assuming the tool itself is broken. For advanced setups, including wildcard certificates and DNS-based validation, the official Certbot documentation covers every option the tool supports.

No ticket needed, and no certificate to purchase either. One command, and your nginx site runs on HTTPS from here on out. The renewal timer Certbot sets up means this is genuinely a one-time task, not something you revisit every 90 days.

See more guides in Docs, or check out Install Let’s Encrypt SSL on Windows Server IIS if you manage a Windows server as well.

H

Hanna Taoufik

The Hostner team writes about servers, Linux, security, and everything that comes with running your own infrastructure, so you can skip the support ticket.