Free SSL Certificate with Let’s Encrypt and Certbot: Complete 2026 Guide

A free SSL certificate allows you to secure a website with HTTPS without paying a yearly certificate fee. Fortunately, Let’s Encrypt provides trusted certificates for free. Moreover, Certbot can automate both installation and renewal.

Free SSL Certificate Quick Answer

A free SSL certificate protects data as it moves between a visitor and your web server. However, encryption is only part of the process. Browsers must also trust the organization that issued the certificate.

Therefore, Let’s Encrypt is useful because it acts as a trusted certificate authority. In addition, it uses automation so certificates can be issued and renewed without a manual purchase process.

What You Need Before Installing SSL

Before you begin, make sure the basic server setup already works. Otherwise, Let’s Encrypt may not be able to verify your domain.

Domain and Server Requirements

• A registered domain name.
• A public server or VPS.
• Root or sudo access.
• A working nginx or Apache web server.
• Correct DNS records.
• Port 80 available for HTTP validation.
• Port 443 available for HTTPS traffic.

Why These Requirements Matter

First, your domain must point to the server that will answer the validation request. Next, the web server must be reachable publicly. Finally, Let’s Encrypt must be able to confirm that you control the domain.

What Does an SSL Certificate Actually Do?

SSL Protects Data in Transit

When a visitor opens an HTTPS website, the browser and server create an encrypted connection. As a result, information sent between them is much harder for another party to read while it is traveling across the network.

For example, login details, form submissions and session information can all benefit from HTTPS protection. Therefore, modern websites should normally use HTTPS instead of plain HTTP.

TLS Is the Modern Technology

Although people still say “SSL certificate,” modern secure websites actually use TLS. Nevertheless, the phrase SSL certificate remains common because most hosting companies and website owners recognize it.

HTTPS Also Helps Verify the Server

Encryption alone is not enough. In addition, the browser needs a way to verify that the certificate belongs to the domain being visited.

For this reason, trusted certificate authorities play an important role. They verify domain control before issuing certificates that browsers recognize.

Why Self-Signed SSL Certificates Cause Browser Warnings

A Self-Signed Certificate Can Still Encrypt Traffic

You can create a certificate yourself. Technically, that certificate may still provide encryption. However, browsers do not automatically trust certificates simply because they exist.

The Missing Piece Is Independent Trust

With a self-signed certificate, the server is essentially confirming its own identity. Therefore, there is no independent certificate authority telling the browser that the domain was properly verified.

Check a Certificate with OpenSSL

For example, OpenSSL can show the certificate subject and issuer. Therefore, it is a useful troubleshooting tool when you want to know which certificate a server is presenting.

openssl s_client -connect example.com:443 2>/dev/null \
| openssl x509 -noout -subject -issuer

What Is Let’s Encrypt?

Let’s Encrypt Is a Free Certificate Authority

Let’s Encrypt is a publicly trusted certificate authority operated by the nonprofit Internet Security Research Group.

Most importantly, it provides certificates without charging a certificate fee. Therefore, website owners can enable HTTPS without buying a traditional SSL certificate.

Let’s Encrypt Uses Automation

Instead of relying on a long manual process, Let’s Encrypt uses the ACME protocol. As a result, software can request certificates, complete domain validation and renew certificates automatically.

How the ACME Process Works

First, your ACME client asks for a certificate. Next, the certificate authority asks the client to prove control of the domain. Finally, a certificate is issued after successful validation.

What Is Certbot?

Certbot is one of the most popular ACME clients. In addition, it includes plugins for web servers such as nginx and Apache.

Therefore, Certbot can make the free SSL certificate installation process much easier for a typical VPS or dedicated server.

HTTP-01 vs DNS-01 SSL Validation

Why Let’s Encrypt Must Validate Your Domain

A certificate authority cannot safely issue a certificate to anyone who types a domain name into a command. Instead, it needs proof that the requester actually controls the domain.

Therefore, Let’s Encrypt uses domain validation challenges. Two important methods are HTTP-01 and DNS-01.

How HTTP-01 Validation Works

With HTTP-01, Certbot creates a temporary verification resource on your web server. Then, Let’s Encrypt requests that resource over HTTP.

For example, the verification URL can look similar to this:

http://example.com/.well-known/acme-challenge/TOKEN

If Let’s Encrypt receives the expected token, the challenge succeeds. Therefore, this method is straightforward for normal public websites.

When HTTP-01 Is a Good Choice

• Normal public websites.
• Single domains or specific subdomains.
• nginx and Apache servers.
• Servers with port 80 publicly reachable.

How DNS-01 Validation Works

DNS-01 works differently. Instead of placing a validation file on the web server, your ACME client creates a temporary DNS TXT record.

For example:

_acme-challenge.example.com

Then, Let’s Encrypt checks public DNS for the expected value. Therefore, the web server itself does not need to serve the validation token.

When DNS-01 Is a Better Choice

• Wildcard SSL certificates.
• Servers where port 80 cannot be exposed.
• Multiple subdomains.
• Infrastructure with automated DNS APIs.

HTTP-01 vs DNS-01 Comparison

How to Get a Free SSL Certificate with Certbot

Step 1: Point the Domain to Your Server

First, open the DNS manager for your domain. Then, create an A record that points your hostname toward the public IPv4 address of your server.

Type: A
Name: app
Value: 203.0.113.20
TTL: Auto

app.example.com → 203.0.113.20

Confirm DNS Before Continuing

After making the change, confirm that public DNS resolvers return the correct IP address. Otherwise, the certificate request may fail even if your nginx configuration is perfect.

dig +short app.example.com

Step 2: Open Ports 80 and 443

Next, allow HTTP and HTTPS traffic through your server firewall. Because HTTP-01 validation uses HTTP, port 80 must normally be reachable.

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

Check Your Hosting Provider Firewall Too

In addition to the operating-system firewall, many VPS providers have their own network firewall. Therefore, check both locations if Let’s Encrypt cannot reach your server.

Step 3: Install Certbot

Once DNS and firewall settings are ready, install Certbot. In this example, nginx is already installed on Ubuntu.

sudo apt update

sudo apt install -y certbot python3-certbot-nginx

Why Install the nginx Plugin?

The nginx plugin helps Certbot understand your existing server configuration. As a result, Certbot can often install the certificate without requiring you to manually edit every SSL directive.

Step 4: Request the Free SSL Certificate

Now request your certificate. However, replace the example hostname and email address with your own information.

sudo certbot --nginx \
-d app.example.com \
-m you@example.com \
--agree-tos \
--redirect

What the Certbot Options Mean

The –nginx option enables nginx integration. Meanwhile, -d identifies the domain that should appear on the certificate.

In addition, –redirect tells Certbot to send normal HTTP visitors to the HTTPS version of the site.

Step 5: Test HTTPS

After Certbot finishes, open your HTTPS URL in a browser. Alternatively, you can test the response directly from the command line.

curl -I https://app.example.com

Step 6: Test the HTTP Redirect

Next, verify that the insecure HTTP version redirects to HTTPS. Therefore, users who type the old URL will still arrive at the secure version.

curl -I http://app.example.com

Where Certbot Stores Your SSL Certificate

The Main Let’s Encrypt Directory

After Certbot issues the certificate, it normally keeps the active certificate files under:

/etc/letsencrypt/live/YOUR-DOMAIN/

Therefore, this directory is important when configuring nginx, containers or reverse proxies manually.

What Is privkey.pem?

The privkey.pem file contains your private key. Most importantly, this file must stay private.

What Is fullchain.pem?

The fullchain.pem file contains your certificate together with the supporting certificate chain. Therefore, this is commonly the file nginx uses for ssl_certificate.

What Is cert.pem?

The cert.pem file contains your server certificate itself. However, it does not include the complete intermediate certificate chain.

What Is chain.pem?

The chain.pem file contains the intermediate certificate chain. Some software expects this information separately.

Example nginx SSL Configuration

server {
    listen 443 ssl;
    server_name app.example.com;

    ssl_certificate
        /etc/letsencrypt/live/app.example.com/fullchain.pem;

    ssl_certificate_key
        /etc/letsencrypt/live/app.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:3000;
    }
}

How to Get a Free Wildcard SSL Certificate

What Is a Wildcard Certificate?

A wildcard certificate can cover many subdomains. For example, one certificate can be useful when you operate several services under the same main domain.

• blog.example.com
• app.example.com
• crm.example.com
• shop.example.com

Wildcard Certificate Format

The wildcard hostname normally looks like:

*.example.com

However, wildcard certificates require DNS-01 validation. Therefore, the normal HTTP-01 process cannot issue the wildcard name.

Install the Cloudflare DNS Plugin

If your DNS is hosted by Cloudflare, Certbot can work with the Cloudflare API. First, install the required plugin.

sudo apt install -y python3-certbot-dns-cloudflare

Create a Restricted Cloudflare API Token

Next, create a Cloudflare API token with only the DNS permissions that Certbot needs. In other words, do not use a broad token if a restricted one will work.

Create the Credentials File

sudo mkdir -p /root/.secrets

sudo nano /root/.secrets/cloudflare.ini

Add the API Token

dns_cloudflare_api_token = YOUR_API_TOKEN

Protect the Credentials File

Because the token can modify DNS records, protect the file carefully. Therefore, restrict access to the root user.

sudo chmod 600 /root/.secrets/cloudflare.ini

Request the Wildcard Certificate

Now Certbot can complete DNS-01 validation automatically.

sudo certbot certonly \
--dns-cloudflare \
--dns-cloudflare-credentials /root/.secrets/cloudflare.ini \
-d "*.example.com" \
-d example.com \
--agree-tos

Why Include example.com Too?

A wildcard such as *.example.com covers subdomains. However, it does not automatically cover the bare example.com hostname.

Therefore, requesting both names gives you broader coverage.

How DNS-01 Validation Happens

First, Certbot receives a validation token. Next, the DNS plugin publishes a temporary TXT record. Finally, Let’s Encrypt checks the record before issuing the certificate.

How to Renew a Free SSL Certificate Automatically

Why SSL Renewal Matters

Installing your free SSL certificate once is not enough. Eventually, the certificate reaches its expiration date.

Therefore, production websites should use automatic renewal instead of depending on someone to remember a calendar date.

Check the Certbot Timer

On many Ubuntu systems, Certbot uses a systemd timer. First, check whether that timer is active.

systemctl status certbot.timer

systemctl list-timers | grep certbot

Run a Renewal Dry Run

Next, perform a simulated renewal. This step is especially important because it verifies that the current validation method still works.

sudo certbot renew --dry-run

Why the Dry Run Is Important

A configuration may work today but fail later after a firewall, DNS or nginx change. Therefore, testing renewal can reveal a problem before the live certificate expires.

List Your Existing Certificates

sudo certbot certificates

This command shows useful information such as certificate names, domains, file paths and expiration dates.

Inspect Expiration Dates with OpenSSL

openssl x509 \
-in /etc/letsencrypt/live/example.com/fullchain.pem \
-noout \
-dates \
-issuer \
-subject

Do Not Depend on Expiration Reminder Emails

Let’s Encrypt ended its certificate expiration email notification service in 2025. Therefore, automatic renewal and independent monitoring are more important than waiting for an email reminder.

Automatic HTTPS Without Manual Certbot Commands

Modern Reverse Proxies Can Manage Certificates

Understanding Certbot is useful. However, many modern deployment tools can manage ACME certificates automatically.

As a result, you may not need to run Certbot manually for every application.

Caddy Automatic HTTPS

Caddy is known for automatic HTTPS. In many configurations, you provide the hostname and Caddy handles certificate issuance and renewal.

Traefik and ACME

Traefik includes ACME certificate resolvers. Therefore, it is popular in containerized environments.

Coolify and SSL Automation

Coolify can deploy applications behind a reverse proxy. In addition, it can automate HTTPS for configured domains.

Nginx Proxy Manager

Nginx Proxy Manager provides a graphical interface for managing proxy hosts. Moreover, it supports Let’s Encrypt certificates.

Why the Reverse Proxy Often Owns SSL

Suppose several applications run on the same server. In that case, one reverse proxy may already receive all incoming HTTPS traffic.

blog.example.com  → WordPress
app.example.com   → Node.js
crm.example.com   → CRM
api.example.com   → API

                    ↓

              Reverse Proxy
                    ↓
                  HTTPS

Therefore, letting the reverse proxy own the SSL certificates can simplify the entire architecture.

Free SSL Certificate Lifetimes and Automation

Let’s Encrypt Certificates Are Short-Lived

Let’s Encrypt certificates are intentionally designed for automated renewal. Consequently, you should build your setup around automation instead of manual replacement.

Shorter Lifetimes Increase the Need for Automation

Certificate lifetimes are expected to become shorter over time. Therefore, manually tracking every certificate becomes an increasingly poor strategy.

Use an Automation-First Setup

Ideally, your server should be able to issue, renew and deploy certificates without human intervention. As a result, shorter certificate lifetimes should have little effect on normal website operations.

Common Free SSL Certificate Problems

Problem 1: The Let’s Encrypt Challenge Fails

First, verify that the domain points to the correct server. Next, check port 80. Finally, confirm that your web server is actually running.

• Check the DNS A record.
• Check the server firewall.
• Check the cloud firewall.
• Confirm nginx or Apache is running.
• Confirm another service is not using port 80.

Problem 2: DNS Has Not Finished Updating

DNS changes are not always visible everywhere immediately. Therefore, check more than one public resolver before requesting the certificate again.

dig +short example.com

dig +short example.com @1.1.1.1

dig +short example.com @8.8.8.8

Problem 3: nginx Has a Configuration Error

Before reloading nginx, test its configuration. Otherwise, a typo can cause unnecessary downtime.

sudo nginx -t

sudo systemctl reload nginx

Problem 4: The Wrong Certificate Appears

Sometimes the site loads over HTTPS but presents the wrong certificate. Therefore, inspect the actual certificate returned by the public hostname.

openssl s_client \
-connect example.com:443 \
-servername example.com \
2>/dev/null \
| openssl x509 -noout -issuer -subject -dates

Problem 5: Wildcard Renewal Stops Working

If wildcard renewal fails, check the DNS API configuration first. For example, an expired API token can prevent the required TXT record from being created.

• Confirm the API token still works.
• Confirm DNS permissions are correct.
• Check the credentials file.
• Check file permissions.
• Update Certbot if you changed DNS providers.

Problem 6: HTTPS Works but the Page Is Still Not Fully Secure

In this case, the problem may be mixed content. For example, your HTTPS page might still load an image, script or stylesheet through HTTP.

Therefore, replace insecure resource URLs with HTTPS versions.

Problem 7: WordPress Redirects Incorrectly

First, check the WordPress Address and Site Address. Both should use HTTPS. Next, clear your WordPress cache. Finally, clear CDN and reverse proxy caches if you use them.

Useful SSL and HTTPS Tools

Let’s Encrypt Documentation

Certbot Setup Instructions

Test Your SSL Configuration

Search Certificate Transparency Logs

Free SSL Certificate FAQ

Is Let’s Encrypt Really Free?

Yes. Let’s Encrypt does not charge website owners a certificate fee. Therefore, you can use it to get a free SSL certificate for many normal websites and applications.

Is a Free SSL Certificate Secure?

Yes. A free Let’s Encrypt certificate provides standard browser-trusted TLS encryption. In other words, “free” does not mean that the cryptography is intentionally weaker.

Can I Use a Free SSL Certificate on WordPress?

Yes. WordPress does not require a special paid SSL certificate. Therefore, once your hosting environment provides HTTPS, WordPress can use the secure connection.

Can I Use Let’s Encrypt with nginx?

Yes. Certbot includes nginx integration. As a result, it can automate much of the certificate installation process.

Can Let’s Encrypt Create Wildcard Certificates?

Yes. However, wildcard certificates require DNS-01 validation instead of HTTP-01 validation.

Does *.example.com Also Cover example.com?

No. The wildcard covers subdomains. Therefore, request example.com separately if you also want the root domain on the certificate.

Do I Need Port 80 Open?

For HTTP-01 validation, port 80 generally needs to be reachable. However, DNS-01 validation does not require Let’s Encrypt to reach your server on port 80.

How Do I Test Automatic SSL Renewal?

Use sudo certbot renew –dry-run. Because the command performs a simulated renewal, it can identify problems before your certificate expires.

Can I Use Let’s Encrypt with Cloudflare?

Yes. However, remember that Cloudflare’s connection to the visitor and Cloudflare’s connection to your origin server are separate connections. Therefore, configure both layers correctly.

What Happens If My SSL Certificate Expires?

Browsers can show a certificate warning or refuse to trust the connection. As a result, an otherwise functioning website may become effectively unavailable to visitors.

Should I Buy an SSL Certificate Instead?

For many websites, blogs and applications, a free Let’s Encrypt certificate is sufficient. However, organizations with specialized compliance or identity requirements may have additional certificate needs.

Final Thoughts on Getting a Free SSL Certificate

A free SSL certificate makes it possible to secure a website without adding another yearly certificate bill. Moreover, Let’s Encrypt and Certbot make the process relatively simple.

First, configure your DNS correctly. Next, issue the certificate. Then, redirect HTTP traffic to HTTPS. Finally, test automatic renewal.

Therefore, the best SSL setup is not merely one that works today. Instead, it should continue renewing automatically as your website and server configuration change.