The Complete Guide to Let's Encrypt & Certbot

Let's Encrypt is a free, automated, and open Certificate Authority (CA) provided by the Internet Security Research Group (ISRG). It has revolutionized web security by making it possible for anyone to obtain and install a trusted SSL/TLS certificate at no cost. The key to its success is automation, primarily through the ACME protocol and client software like Certbot.

How Let's Encrypt Works: The ACME Protocol

Let's Encrypt uses the Automated Certificate Management Environment (ACME) protocol to verify that you control a given domain name and to issue a certificate. The process is entirely automated:

1. An ACME client on your web server (like Certbot) tells the Let's Encrypt CA it wants to secure a domain (e.g., `yourdomain.com`).
2. The CA gives the client a "challenge"—a unique token that it needs to make available on the website in a specific way.
3. The client places the token where the CA can find it. This proves the client controls the domain. There are two common challenge types:
   • HTTP-01 Challenge: The client places a file with the token at a specific URL on the website (e.g., `http://yourdomain.com/.well-known/acme-challenge/<token>`).
   • DNS-01 Challenge: The client adds a specific TXT record containing the token to the domain's DNS records. This is required for issuing wildcard certificates.
4. Once the CA verifies the token, it knows the client is legitimate. The client then generates a Certificate Signing Request (CSR), sends it to the CA, and the CA returns a signed SSL certificate.

This entire process takes seconds and can be fully automated.

Introducing Certbot: The #1 ACME Client

Certbot is a free, open-source software tool for automatically using Let's Encrypt certificates on manually-administered websites to enable HTTPS. It's the most popular ACME client and is maintained by the Electronic Frontier Foundation (EFF).

Certbot can:

• Automatically prove to Let's Encrypt that you control the website.
• Fetch a certificate for your domain(s).
• Install the certificate on your web server (Apache or Nginx).
• Automatically configure your web server to serve HTTPS.
• Automatically renew the certificate before it expires.

Installing and Using Certbot

Installation varies by operating system. The recommended way to install Certbot is using Snap, which ensures you always have the latest version.

sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbot

For Nginx Web Servers

If you use Nginx, Certbot can automatically find your server blocks, install the certificate, and configure HTTPS for you.

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

For Apache Web Servers

The process is nearly identical for Apache.

sudo certbot --apache -d yourdomain.com -d www.yourdomain.com

Getting a Wildcard Certificate (DNS Challenge)

To get a wildcard certificate (`*.yourdomain.com`), you must use the DNS-01 challenge. This requires a Certbot plugin for your DNS provider (e.g., Cloudflare, Route 53, GoDaddy).

# 1. Install the Cloudflare DNS plugin
sudo snap set certbot trust-plugin-with-root=ok
sudo snap install certbot-dns-cloudflare

# 2. Create Cloudflare API token credentials file
# (e.g., /etc/letsencrypt/cloudflare.ini)
# dns_cloudflare_api_token = YOUR_API_TOKEN

# 3. Run Certbot
sudo certbot certonly \
  --dns-cloudflare \
  --dns-cloudflare-credentials /etc/letsencrypt/cloudflare.ini \
  -d yourdomain.com -d '*.yourdomain.com'

Important Considerations