Skip to main content
Certificate issuance

Request Free HTTPS Certificates with Certbot

Install Certbot, choose a validation method, configure your server, and automate Let's Encrypt renewal.

CertOne2 min read

Certbot is a widely used client for Let's Encrypt. This guide shows how to request free HTTPS certificates with it.

1. What is Certbot?​

Certbot is a free, open-source tool developed by the Electronic Frontier Foundation (EFF) for obtaining and managing SSL/TLS certificates from CAs such as Let's Encrypt. It simplifies HTTPS adoption and helps protect online privacy. Certbot offers command-line workflows and automatic configuration plugins for servers such as Apache and NGINX. Certificates can also be installed on other servers through appropriate manual workflows. Automation reduces repetitive work and configuration errors.

2. Request an HTTPS certificate​

1. Install Certbot​

Choose the installation method appropriate to your operating system and server software. See Certbot for supported installation options, including package-manager methods. For example, on Ubuntu:

sudo apt-get update
sudo apt-get install certbot

2. Prepare the domain and server​

Make sure the domain resolves to the server's IP address. Configure DNS through your registrar or DNS hosting provider. Install and configure the web server, such as Apache or NGINX, and confirm the website is accessible by its domain name.

3. Choose a validation method​

Certbot supports several methods for proving domain control:

  • HTTP validation: places a temporary challenge file on the server for the CA to retrieve at a specific URL. This suits many web-server environments.
  • DNS validation: creates a specified TXT record in the domain's DNS zone. Use it when HTTP validation is unsuitable or unavailable.

4. Run Certbot to request the certificate​

  • HTTP validation:
sudo certbot certonly --webroot -w /path/to/webroot -d example.com

  • --webroot selects HTTP validation using an existing document root.

  • -w /path/to/webroot sets the directory where Certbot places challenge files.

  • -d example.com specifies a domain; repeat it for additional names.

  • DNS validation with Cloudflare: Install the relevant plugin. For Cloudflare, install certbot-dns-cloudflare:

sudo apt-get install certbot-dns-cloudflare

Obtain Cloudflare API credentials:

  • Sign in to Cloudflare.
  • Open My Profile from the account menu.
  • Select API Tokens.
  • Click Create Token.
  • Grant Zone DNS Edit permission and select the required zones.
  • Name and create the token.
  • Copy it immediately and store it securely; it is shown only once.

Run Certbot:

sudo certbot certonly --dns-cloudflare --dns-cloudflare-credentials /path/to/credentials.txt -d example.com
  • --dns-cloudflare selects Cloudflare DNS validation.
  • --dns-cloudflare-credentials /path/to/credentials.txt specifies the credentials file. Store the token using the plugin's dns_cloudflare_api_token = YOUR_TOKEN setting.
  • -d example.com specifies a domain; repeat it for additional names.

5. Configure the web server​

After issuance, Certbot saves the certificate and private key in its certificate directory. Configure your web server to use these files for HTTPS. For NGINX, add the following to the server configuration:

server {
    listen 443 ssl;
    server_name example.com www.example.com;
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    # Add the remaining server configuration here.
}

6. Automatic renewal​

The Let's Encrypt certificates described in this guide have 90-day validity. Certbot can renew them automatically before expiration. Schedule certbot renew with cron if your installation does not already provide a renewal timer. The following example runs monthly; use a sufficiently frequent schedule for your certificate lifetime and retry needs:

sudo crontab -e

Add this line in the editor:

0 0 1 */2 * sudo certbot renew --quiet

This example runs the renewal command at midnight on the first day of each month.

Certbot simplifies HTTPS issuance and management. Regular renewal and verification keep certificates valid and help avoid service interruptions.