Jay Taylor's notes

back to listing index

Certbot - Ubuntuartful Nginx

[web search]
Original source (certbot.eff.org)
Tags: ubuntu ssl nginx letsencrypt certbot certbot.eff.org
Clipped on: 2018-09-10

Trying to get a wildcard certificate? Please use the dropdown menus below to get instructions specific to your system, and read those instructions carefully.

Automatically enable HTTPS on your website with EFF's Certbot, deploying Let's Encrypt certificates.

No javascript? See all setup instructions here. Read the full documentation here.

Nginx on Ubuntu 17.10 (artful)

Automated
Advanced

Note:

Certbot is meant to be run on the server where your website is hosted. If you don't have administrative shell access to your webserver or you're not familiar with command line server administration, you should check if your hosting provider has built-in Let's Encrypt support by contacting them or checking this list of supporting providers.

Install

On Ubuntu systems, the Certbot team maintains a PPA. Once you add it to your list of repositories all you'll need to do is apt-get the following packages. 

$ sudo apt-get update
$ sudo apt-get install software-properties-common
$ sudo add-apt-repository ppa:certbot/certbot
$ sudo apt-get update
$ sudo apt-get install python-certbot-nginx

Certbot's DNS plugins which can be used to automate obtaining a wildcard certificate from Let's Encrypt's ACMEv2 server are not available for your OS yet. This should change soon but if you don't want to wait, you can use these plugins now by running Certbot in Docker instead of using the instructions on this page.

Get Started

Certbot has an Nginx plugin, which is supported on many platforms, and certificate installation. 

$ sudo certbot --nginx

Running this command will get a certificate for you and have Certbot edit your Nginx configuration automatically to serve it. If you're feeling more conservative and would like to make the changes to your Nginx configuration by hand, you can use the certonly subcommand: 

$ sudo certbot --nginx certonly
To learn more about how to use Certbot read our documentation.

Automating renewal

The Certbot packages on your system come with a cron job that will renew your certificates automatically before they expire. Since Let's Encrypt certificates last for 90 days, it's highly advisable to take advantage of this feature. You can test automatic renewal for your certificates by running this command: 

$ sudo certbot renew --dry-run

More detailed information and options about renewal can be found in the full documentation.