DEV Community

Sai Praveen Sanapalli
Sai Praveen Sanapalli

Posted on

Stop Paying for SSL Certificates — Free HTTPS using Let's Encrypt and Certbot

#https #ssl #certbot #letsencrypt

If you're deploying a website or API, securing it with HTTPS is non-negotiable. But SSL/TLS certificates used to be expensive. Enter Let's Encrypt and Certbot — two tools that democratized secure web traffic.

What is Let's Encrypt?

Let's Encrypt is a free, automated certificate authority (CA) launched in 2015 by the Internet Security Research Group (ISRG). It issues SSL/TLS certificates that enable HTTPS encryption for your website.

Key features:

  • Free — no cost, no hidden fees
  • Automated — certificates can be issued and renewed programmatically
  • Fast — certificates are issued in seconds
  • Short-lived — certificates expire after 90 days, encouraging automation
  • Open — the entire process is transparent and open-source

The 90-day expiration might seem inconvenient, but it's actually a security feature. Short-lived certificates reduce the impact of key compromise and encourage automated renewal workflows.

What is Certbot?

Certbot is a free, open-source tool developed by the Electronic Frontier Foundation (EFF) that automates the process of obtaining and renewing Let's Encrypt certificates.

Why you need it:

Certbot handles the entire certificate lifecycle:

  • Proves domain ownership via HTTP or DNS challenges
  • Obtains certificates from Let's Encrypt
  • Installs certificates on your server
  • Automatically renews certificates before expiration
  • Works with major web servers (Nginx, Apache, etc.)

How They Work Together

Here's the typical flow:

┌─────────────┐
│   Certbot   │ (Your computer or server)
└─────────────┘
      │
      │ Uses ACME protocol
      ▼
┌─────────────────────┐
│  Let's Encrypt      │ Issues certificate
│  (Certificate Auth) │
└─────────────────────┘
      │
      ▼
┌─────────────┐
│ Your Server │ (HTTPS enabled)
└─────────────┘
Enter fullscreen mode Exit fullscreen mode

Getting Started: A Quick Example

Installing Certbot 

# Ubuntu/Debian
sudo apt-get install certbot python3-certbot-nginx

# macOS
brew install certbot

# Or use pip
pip install certbot
Enter fullscreen mode Exit fullscreen mode

Obtaining a Certificate

For Nginx:

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com
Enter fullscreen mode Exit fullscreen mode

For Apache:

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Standalone (if you don't have a web server yet):

sudo certbot certonly --standalone -d yourdomain.com
Enter fullscreen mode Exit fullscreen mode

Automatic Renewal

Certbot sets up a cron job or systemd timer automatically:

# Verify renewal works
sudo certbot renew --dry-run
Enter fullscreen mode Exit fullscreen mode

Certificates are renewed 30 days before expiration, so you never have to think about it.

Real-World Benefits

Before Let's Encrypt/Certbot:

  • SSL certificates cost $50-200+ per year
  • Manual renewal process
  • Discouraged small projects from using HTTPS

After Let's Encrypt/Certbot:

  • Free, automated HTTPS for everyone
  • Security is no longer a luxury feature
  • Millions of websites are now encrypted
  • Perfect for side projects, portfolios, and staging servers

Common Use Cases

1. Single Domain 

certbot certonly -d example.com
Enter fullscreen mode Exit fullscreen mode

2. Multiple Domains 

certbot certonly -d example.com -d www.example.com -d api.example.com
Enter fullscreen mode Exit fullscreen mode

3. Wildcard Certificate (covers all subdomains) 

certbot certonly --manual --preferred-challenges=dns -d '*.example.com' -d example.com
Enter fullscreen mode Exit fullscreen mode

4. Docker Deployment 

FROM nginx:latest
RUN apt-get update && apt-get install -y certbot python3-certbot-nginx
COPY entrypoint.sh /entrypoint.sh
CMD ["/entrypoint.sh"]
Enter fullscreen mode Exit fullscreen mode

Challenges You Might Face

DNS Challenge Failed: Make sure your DNS records are updated before validation completes.

Port 80 Not Available: Use DNS validation instead of HTTP validation with --preferred-challenges=dns.

Certificate Not Renewing: Check that your renewal cron job is running or set up a systemd timer.

Multiple Certificates: Certbot can manage multiple certificates. Keep them organized and renewed separately if needed.

Best Practices

✅ Do:

  • Set up automatic renewal and monitor it
  • Keep Certbot updated
  • Use DNS validation for wildcard certificates
  • Test renewal with --dry-run first
  • Store your certificates securely

❌ Don't:

  • Manually manage certificate renewal
  • Share your private keys
  • Use the same certificate across different domains (unless it's a wildcard)
  • Ignore renewal failures

Alternatives

While Certbot is the most popular, alternatives for Certbot:

  • Certify the Web — Windows GUI
  • acme.sh — Lightweight shell script
  • Lego — Go-based ACME client
  • Caddy — Web server with built-in auto HTTPS
  • Traefik — Reverse proxy with automatic ACME management
  • ZeroSSL — Free alternative CA with a limited number of free certificates (check their current terms, as limits change)
  • Buypass Go SSL — Free CA with wildcard support and 180-day validity

But Certbot remains the gold standard for Linux/Unix systems.

Conclusion

Let's Encrypt and Certbot have made HTTPS the default, not a premium feature. Whether you're running an enterprise application, a side project, or a personal blog, there's no reason not to use them. Setup takes minutes, renewal is automatic, and you get encryption for free.

Start securing your domain today! 🔒

Top comments (0)