Installing Let's Encrypt is the fastest and cheapest way to secure your website with HTTPS. Let's Encrypt is a free, automated certificate authority that makes it possible to obtain SSL/TLS certificates at no cost. In this step-by-step guide you learn how to install a Let's Encrypt certificate on various platforms and how to make sure your certificate is renewed automatically.

What is Let's Encrypt and why install a Let's Encrypt certificate?

Benefits of Let's Encrypt

• 100% free - no cost for the certificate or renewal
• Automated - installation and renewal through Certbot or other tools
• Trusted - recognized by all major browsers and operating systems
• Secure - uses the same encryption standards as paid certificates
• Fast - certificate available in minutes, no waiting period
• Wildcard support - one certificate for all subdomains

Let's Encrypt vs. paid SSL certificates

Characteristic	Let's Encrypt	Paid (DV)	Paid (OV/EV)
Price	Free	€10-100/year	€100-500/year
Validation type	Domain Validation	Domain Validation	Organization/Extended
Validity	90 days (auto-renew)	1 year	1-2 years
Encryption	Identical	Identical	Identical
Browser trust	Full	Full	Full + company name
Warranty	None	$10,000-250,000	$250,000-1,750,000
Wildcard	Yes	Sometimes (extra cost)	Yes

For most websites, Let's Encrypt is more than enough. Only if you need an Extended Validation certificate (with a company name in the browser) or want a financial warranty is a paid certificate necessary. Read more about SSL certificate cost if you want to compare the options.

Installing Let's Encrypt with Certbot

Preparation

Before you start installing Let's Encrypt, check the following:

• You have SSH access to your server (read our guide about server connections)
• Your domain points to the IP address of your server (DNS set up correctly)
• Ports 80 and 443 are open in your firewall
• Your web server (Apache or Nginx) is installed and configured

Installing Let's Encrypt on Ubuntu with Nginx

Step 1: Install Certbot

On Ubuntu you install Certbot and the Nginx plugin through the package manager. It is recommended to install Certbot through snap, which ensures you get the most recent version. The snap package is called certbot and the accompanying Nginx plugin is installed automatically.

Step 2: Request the certificate

Run the certbot command with the --nginx flag. Certbot automatically detects your configured domains and asks which ones you want to secure. The command: sudo certbot --nginx

Certbot will ask you for:

1. Your email address (for urgent notifications and renewal reminders)
2. Agreement with the terms of service
3. Whether you want to support the Electronic Frontier Foundation
4. Which domains you want to secure

Step 3: Automatic configuration

Certbot automatically configures your Nginx server for HTTPS. It adds the correct SSL directives to your server block, including the path to the certificate and the private key. Optionally, it also configures a redirect from HTTP to HTTPS.

Step 4: Test automatic renewal

Let's Encrypt certificates are valid for 90 days. Certbot automatically installs a timer or cron job that renews the certificate before it expires. Test the automatic renewal with: sudo certbot renew --dry-run

Installing Let's Encrypt on Ubuntu with Apache

Step by step

1. Install Certbot with the Apache plugin through snap
2. Run the command: sudo certbot --apache
3. Select the domains you want to secure
4. Choose whether you want to redirect HTTP to HTTPS
5. Certbot configures Apache automatically
6. Test the automatic renewal

Installing Let's Encrypt through DirectAdmin

1. Log in to DirectAdmin as a user
2. Go to SSL Certificates under Account Manager
3. Select Free & automatic certificate from Let's Encrypt
4. Tick the domains and subdomains you want to secure
5. Click Save
6. DirectAdmin installs and configures the certificate automatically
7. Automatic renewal is also set up automatically

Installing Let's Encrypt for wildcard domains

DNS challenge method

Wildcard certificates require DNS validation instead of HTTP validation. You need to add a TXT record to your DNS configuration to prove that you manage the domain. The command: sudo certbot certonly --manual --preferred-challenges dns -d *.yourdomain.com -d yourdomain.com

Certbot gives you a value that you need to add as a TXT record at _acme-challenge.yourdomain.com. After adding the record you wait until the DNS has propagated and confirm in Certbot.

Automatic DNS challenge

For automatic renewal of wildcard certificates you need a DNS plugin that automatically adjusts the TXT records. Certbot has plugins for popular DNS providers such as Cloudflare, Route53, and DigitalOcean.

Troubleshooting when installing Let's Encrypt

DNS does not point to this server

Let's Encrypt verifies whether your domain points to your server. Check your DNS settings and wait until any changes have propagated (this can take up to 24 hours).

Port 80 is blocked

The HTTP challenge of Let's Encrypt requires port 80 to be reachable. Check your firewall settings and make sure no other service is running on port 80.

Rate limit reached

Let's Encrypt has rate limits: a maximum of 50 certificates per registered domain per week and a maximum of 5 failed validations per account per hour. Use the staging environment (--staging flag) for testing so you do not use up your rate limit.

Certificate is not renewed automatically

Check whether the Certbot timer is active with systemctl status certbot.timer. If the timer is not running, restart it. Also check the Certbot logs for any error messages.

After installing Let's Encrypt: optimizing HTTPS

Set up HTTP to HTTPS redirect

Make sure all HTTP traffic is automatically forwarded to HTTPS. Certbot can configure this automatically, but check whether the redirect works correctly for all pages on your website.

Activate HSTS

HTTP Strict Transport Security (HSTS) tells browsers that your website must always be accessed over HTTPS. Add the HSTS header to your web server configuration with a suitable max-age value (at least 31536000 seconds = 1 year).

Solve mixed content

After switching to HTTPS, "mixed content" warnings can occur if your page loads HTTP resources (images, scripts, stylesheets). Search your website for HTTP links and replace them with HTTPS or protocol-relative URLs.

Test the SSL configuration

Test your SSL configuration with tools such as SSL Labs (ssllabs.com/ssltest) to check whether your configuration is secure. Aim for an A+ score by using modern cipher suites and disabling outdated protocols.

Summary

Advanced configuration after installing Let's Encrypt

Configuring OCSP Stapling

OCSP Stapling improves the performance and privacy of your SSL configuration. Normally, the browser checks with a certificate authority whether your certificate is still valid. With OCSP Stapling your web server sends this information along, so the browser does not have to make an extra request. This speeds up the SSL handshake and reduces dependence on external services.

Cipher suite optimization

After installing Let's Encrypt it is important to optimize your cipher suites. Disable outdated and weak cipher suites and prioritize modern, secure options. Use forward secrecy cipher suites so that previously intercepted traffic cannot be decrypted afterwards. Test your configuration with SSL Labs for an A+ score and check periodically whether new vulnerabilities have been discovered.

Certificate Transparency monitoring

Certificate Transparency is an open framework that records all issued SSL certificates in public logs. Monitor these logs for your domain to detect whether any unauthorized certificates have been issued. Tools such as CertSpotter and the Facebook Certificate Transparency Monitor warn you automatically when a new certificate is detected for your domain.

Preventing problems when installing Let's Encrypt

Installing Let's Encrypt: wildcard certificates and DNS validation

For wildcard certificates, DNS validation is required instead of the usual HTTP validation. This means you need to add a special TXT record to your DNS configuration to prove that you are the owner of the domain.

Difference between validation methods

Method	How it works	Wildcard support	Automation
HTTP-01	Place a file in the webroot	No	Easy
DNS-01	Add a TXT record in DNS	Yes	Possible through a DNS API
TLS-ALPN-01	Special TLS response on port 443	No	Limited

Most DNS providers offer an API that lets you adjust DNS records automatically. Certbot supports plugins for popular DNS providers such as Cloudflare, DigitalOcean, Route53, and many others. This also lets you renew wildcard certificates fully automatically.

Installing Let's Encrypt: configuring automatic renewal

At installation, Certbot automatically sets up a cron job or systemd timer for renewal. Check whether it is configured correctly:

• Check the systemd timer: the timer runs twice a day by default and only renews certificates that expire within 30 days.
• Post-renewal hooks: configure hooks that automatically reload your web server after renewal. Without a reload, your server keeps using the old certificate.
• Monitor error messages: set up email notifications with Let's Encrypt so you receive a warning if renewal fails.
• Dry-run test: test the renewal process without actually renewing using the --dry-run option to catch problems early.

If you host multiple domains on the same server, you can manage all certificates at once. Certbot automatically keeps track of which certificates expire when and renews them at the right time.

Optimizing your SSL configuration after installing Let's Encrypt

1. Disable outdated protocols: use only TLS 1.2 and TLS 1.3. Older versions (SSL 3.0, TLS 1.0, TLS 1.1) contain known vulnerabilities.
2. Choose strong cipher suites: prioritize AEAD ciphers such as AES-256-GCM and ChaCha20-Poly1305.
3. Activate HSTS: HTTP Strict Transport Security forces browsers to always use HTTPS. Start with a short max-age and increase it gradually.
4. Configure OCSP Stapling: this speeds up certificate validation by letting the server cache and send along the OCSP response.
5. Test with SSL Labs: use the free SSL Server Test from Qualys to assess your configuration. Aim for an A+ score.

A well-configured SSL certificate improves not only security but also your website speed. TLS 1.3 significantly reduces the handshake latency compared to older versions. Combine SSL with a website firewall for complete protection of your web traffic.

Installing Let's Encrypt: multi-domain certificates

With Certbot you can specify multiple domains when requesting a certificate through the -d option. Each domain is validated separately, so make sure all domains point to the correct server before you request the certificate. You can include up to 100 domain names in a single certificate, which is more than enough for most hosting scenarios.

Organize your certificates logically: group domains that belong to the same website or application in a single certificate, and use separate certificates for independent projects. This makes management clearer and prevents a problem with the validation of one domain from blocking the renewal of the entire certificate.

Let's Encrypt alternatives and when they fit better

Extended Validation (EV) certificates require an extensive identity check of the requesting organization and show the company name in the address bar of some browsers. For financial institutions and large online stores, this can build extra trust with visitors. Organization Validation (OV) certificates confirm that the certificate was issued to a verified organization, which is a step above the Domain Validation (DV) that Let's Encrypt uses.

Paid certificates also often offer a warranty that pays out if the certificate is compromised through a mistake by the certificate authority. They also offer longer validity periods of up to a year, which requires less frequent renewal. For the vast majority of websites, however, Let's Encrypt certificates offer identical security at zero cost. The encryption is technically just as strong, regardless of whether the certificate is free or paid. The difference lies solely in the validation level and the warranty terms.

Let's Encrypt and web server integration

For Nginx, certbot with the nginx plugin is the recommended method. The plugin automatically adjusts your Nginx configuration to use the certificate and configures a redirect from HTTP to HTTPS. With Apache the apache plugin works similarly and automatically modifies the virtual host configuration. For LiteSpeed a separate approach is needed: use the certbot standalone mode or integrate through the LiteSpeed WebAdmin panel, which offers built-in support for Let's Encrypt.

With hosting panels such as cPanel, DirectAdmin, and Plesk, Let's Encrypt is often available as a module. This integration makes it possible to request certificates and renew them automatically for all domains on the server with just a few clicks. This is the easiest option and requires no command-line knowledge. After installation, always check whether automatic renewal is configured correctly by running a dry-run test and checking the scheduled renewal task in your cron or systemd timers. A certificate that expires unexpectedly is one of the most common causes of website downtime and harms both visitor trust and your search engine rankings.

Let's Encrypt: frequently asked questions and solutions

Sources and references

• Let's Encrypt, free SSL certificates (letsencrypt.org)
• Cloudflare, Learning Center (cloudflare.com/learning)
• SSL Labs, SSL Server Test by Qualys (ssllabs.com)
• DigitalOcean, Community Tutorials (digitalocean.com/community)
• ACM, Netherlands Authority for Consumers and Markets (acm.nl)