DEV Community

Cover image for How to Obtain a Let's Encrypt SSL Certificate for Nginx on Ubuntu 22.04
Mouhamadou Tidiane Seck
Mouhamadou Tidiane Seck

Posted on Edited on

How to Obtain a Let's Encrypt SSL Certificate for Nginx on Ubuntu 22.04

#nginx #security #linux #devops

Introduction

Securing your web server with SSL is a crucial step in protecting your users' data and ensuring the integrity of your web application. Let’s Encrypt is a popular service that offers free SSL certificates via an automated API, with Certbot as the most commonly used client. In this guide, we'll walk through the process of obtaining a Let’s Encrypt SSL certificate for Nginx on Ubuntu 22.04 using Certbot.

We won't delve deeply into SSL configuration, but by the end of this tutorial, you'll have a valid certificate that renews automatically. Plus, you'll know how to automate the reloading of your service to account for the renewed certificate.

Prerequisites

Before starting, ensure you have the following:

  • An Ubuntu 22.04 server with a non-root user configured with sudo privileges and a basic firewall.
  • Nginx installed, with a server block for your domain.
  • A domain name pointing to your server (replace your_domain in the tutorial with your actual domain).
  • Port 80 must be reachable from the internet. In standalone mode, Certbot runs its own temporary web server on this port, so Nginx has to be stopped while a certificate is issued or renewed (Step 2 automates this with hooks). If you prefer to keep Nginx running, consider using Certbot's webroot mode instead.

Step 1 — Installing Certbot

Certbot recommends using their snap package for installation. Snaps are supported on most Linux distributions, but you'll need snapd installed to manage snap packages. Ubuntu 22.04 supports snaps by default, so start by ensuring your snapd core is up to date:

sudo snap install core; sudo snap refresh core
Enter fullscreen mode Exit fullscreen mode

If you have an older version of Certbot installed, remove it:

sudo apt remove certbot
Enter fullscreen mode Exit fullscreen mode

Then, install the Certbot package:

sudo snap install --classic certbot
Enter fullscreen mode Exit fullscreen mode

Finally, link the Certbot command to your path:

sudo ln -s /snap/bin/certbot /usr/bin/certbot
Enter fullscreen mode Exit fullscreen mode

Certbot is now installed, and we can proceed to obtain our SSL certificate.

Step 2 — Running Certbot

Certbot needs to respond to a cryptographic challenge issued by the Let’s Encrypt API to prove that you control your domain. In standalone mode, it uses port 80 (HTTP) for this purpose. Open port 80 for the challenge and port 443 for the HTTPS traffic Nginx will serve:

sudo ufw allow 80
sudo ufw allow 443
Enter fullscreen mode Exit fullscreen mode

Run Certbot to obtain your certificate, using the --standalone option to let Certbot handle the challenge with its built-in web server. Since Nginx already listens on port 80, the --pre-hook and --post-hook options stop Nginx before the challenge and start it again afterwards. Certbot saves these hooks and reuses them for every renewal:

sudo certbot certonly --standalone -d your_domain \
  --pre-hook "systemctl stop nginx" \
  --post-hook "systemctl start nginx"
Enter fullscreen mode Exit fullscreen mode

You’ll need to enter an email address and accept the terms of service. If successful, Certbot will inform you where the certificates are stored.

Step 3 — Configuring Your Application

Configuring your application for SSL varies depending on the software you use, but let’s explore what Certbot has downloaded. List the directory containing your keys and certificates:

sudo ls /etc/letsencrypt/live/your_domain
Enter fullscreen mode Exit fullscreen mode

The most commonly needed files are:

  • privkey.pem: This is the private key for your certificate. Keep this file secure and private.
  • fullchain.pem: This is your certificate bundled with any intermediate certificates. Most configurations refer to this file as the actual certificate.

For more details on the other files, check the Certbot documentation.

For Nginx, reference these two files in the server block of your site (for example /etc/nginx/sites-available/your_domain):

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name your_domain;

    ssl_certificate /etc/letsencrypt/live/your_domain/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your_domain/privkey.pem;

    # your existing location blocks
}
Enter fullscreen mode Exit fullscreen mode

Then test the configuration and reload Nginx:

sudo nginx -t
sudo systemctl reload nginx
Enter fullscreen mode Exit fullscreen mode

Step 4 — Managing Automatic Renewals with Certbot

Let’s Encrypt certificates are valid for 90 days, encouraging users to automate the renewal process. The Certbot snap package handles this with a systemd timer, which runs twice daily and renews any certificate that is close to expiration. You can check the timer with:

systemctl list-timers | grep certbot
Enter fullscreen mode Exit fullscreen mode

The hooks passed in Step 2 are stored in /etc/letsencrypt/renewal/your_domain.conf, so each renewal stops Nginx, renews the certificate, and starts Nginx again with the new certificate. You can confirm they were saved:

sudo cat /etc/letsencrypt/renewal/your_domain.conf
Enter fullscreen mode Exit fullscreen mode

If another service uses the same certificate, place an executable script in /etc/letsencrypt/renewal-hooks/deploy/ to reload it after each renewal. Then perform a dry run to check for errors (this briefly stops and restarts Nginx):

sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

If there are no errors, you're all set. Certbot will now automatically renew your certificate and execute the necessary commands.

Conclusion

In this tutorial, we installed the Let’s Encrypt Certbot client, obtained an SSL certificate using the standalone mode, configured Nginx to use it, and set up automatic renewals with custom hooks. This process provides a solid foundation for using Let’s Encrypt certificates with various services beyond the typical web server.

Notes

Written for Ubuntu 22.04 LTS with Nginx 1.18.0 from the Ubuntu repositories and Certbot from the snap store.

References

Top comments (0)