If you are running your website on your own VPS or dedicated server, you can request a free Let’s Encrypt certificate using the Certbot program. Certbot carries out domain validation, configures the certificate on the web server and ensures automatic renewal. This is not necessary for cPanel hosting plans, as AutoSSL performs the same tasks there.

Prerequisites

• The A record for the domain (and the www subdomain) points to the server’s IP address.
• Ports 80 and 443 are open on the server’s firewall. Let’s Encrypt checks the domain on port 80; see: How do I set up a firewall on my VPS?
• The domain has already been configured on the web server (Apache or Nginx) and is accessible via HTTP.
• root or sudo privileges.

Installing Certbot

AlmaLinux, Rocky Linux, CloudLinux (8, 9, 10):

dnf install epel-release
dnf install certbot python3-certbot-apache   # Apache esetén
dnf install certbot python3-certbot-nginx    # Nginx esetén

Debian, Ubuntu:

apt update
apt install certbot python3-certbot-apache   # Apache esetén
apt install certbot python3-certbot-nginx    # Nginx esetén

Requesting a certificate

Nginx:

certbot --nginx -d pelda.hu -d www.pelda.hu

Apache:

certbot --apache -d pelda.hu -d www.pelda.hu

When run for the first time, Certbot will ask for your email address (to which it will send notifications if there is anything to be done regarding your account) and for you to accept the terms and conditions. It then carries out the validation, has the certificate issued, and enters it into the web server’s settings. Finally, it also offers to redirect HTTP requests to HTTPS.

If you do not wish to make any changes to the web server settings

With the certonly command, Certbot simply requests the certificate, leaving the web server configuration to you. In --webroot mode, it places the validation file in the website’s root directory:

certbot certonly --webroot -w /var/www/pelda.hu -d pelda.hu -d www.pelda.hu

The certificate files are stored in the /etc/letsencrypt/live/pelda.hu/ directory:

File	Contents	Where should I go?
fullchain.pem	the certificate and the intermediate certificate	Nginx: ssl_certificate, Apache: SSLCertificateFile
privkey.pem	the private key	Nginx: ssl_certificate_key, Apache: SSLCertificateKeyFile
cert.pem	only the certificate	Do not use it on its own, as it is missing the intermediate certificate

The article on intermediate certificates explains why fullchain.pem is the right choice.

Automatic renewal

The Certbot installed from the package also includes a timer (systemd timer) which checks twice a day whether any certificates need renewal. On Debian and Ubuntu, this starts automatically; on AlmaLinux, Rocky Linux and CloudLinux, however, it needs to be enabled:

systemctl enable --now certbot-renew.timer

Check that the timer is running:

systemctl list-timers | grep certbot

You can test the renewal as a trial, without issuing a live certificate, as follows:

certbot renew --dry-run

If the web server needs to be reloaded after renewal (in certonly mode), enter the following command during renewal:

certbot renew --deploy-hook "systemctl reload nginx"

Let’s Encrypt certificates are currently valid for 90 days; from February 2027, they will be valid for 64 days, and from February 2028, for 45 days (see: Why are SSL certificates no longer valid for a year?). Certbot’s default renewal logic is aligned with this. However, if you run renewals at fixed intervals (for example, every 60 days) using your own script, you will need to adjust this: the shorter-validity certificates would have expired by then. Keep Certbot up to date.

The article ‘Manual renewal of Let’s Encrypt certificates via the command line’ covers the manual steps involved in renewal and troubleshooting.

Useful commands

# A szerveren lévő tanúsítványok és lejáratuk
certbot certificates

# Egy domain hozzáadása egy meglévő tanúsítványhoz
certbot --nginx --cert-name pelda.hu -d pelda.hu -d www.pelda.hu -d bolt.pelda.hu

# Egy tanúsítvány törlése
certbot delete --cert-name pelda.hu

Paid certificate with ACME

Certbot does not only work with Let’s Encrypt. If you have purchased a paid certificate with an ACME subscription via the client portal, you will find the Server URL, EAB MAC ID and **EAB MAC **key on the service page. Certbot uses these to automatically request and renew the paid certificate in exactly the same way:

certbot --nginx --server <Server URL> \
  --eab-kid <EAB MAC ID> --eab-hmac-key <EAB MAC key> \
  -d pelda.hu -d www.pelda.hu

We have a separate article on how to apply for a Let’s Encrypt wildcard certificate using DNS validation.