Securing Nginx with Let’s Encrypt

Let’s Encrypt is a certificate authority that issues free TLS certificates, making HTTPS available to every site. Its client, Certbot, automates nearly everything — obtaining a certificate, rewriting the Nginx configuration and setting up renewal.

Before you start

You need an Ubuntu server (the steps were written for 20.04 and apply to later releases), a registered domain — example.com below — with an A record pointing at the server, and an application already served by Nginx.

Install Certbot

Install Certbot and its Nginx plugin with apt:

sudo apt install certbot python3-certbot-nginx

Confirm the Nginx configuration

Certbot finds the right server block by matching its server_name directive to the domains you request. Open your site’s configuration:

sudo nano /etc/nginx/sites-available/example.com

Find the existing server_name line. It should list your domain:

server {
    listen 80;
    server_name example.com www.example.com;
    # …
}

If you changed anything, validate the syntax and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx