# Secure Nginx with Let’s Encrypt

If you're running a website or app, securing it with HTTPS is a must. Not only does HTTPS protect your users’ data with encryption, but it also improves trust and even your site's SEO ranking.

### Let’s Encrypt?

Let’s Encrypt is a free and trusted Certificate Authority (CA) that provides SSL/TLS certificates. Using their service with **Certbot** (the official tool for managing certificates) makes SSL setup almost effortless - especially when paired with Nginx.

Here’s what I had set up before starting:

* A VM running Ubuntu 22.04 on Azure
    
* Nginx installed and running
    
* Ports 80 (HTTP) and 443 (HTTPS) open
    
* A domain name with an A record pointing to the VM’s public IP
    

This ensures that your domain resolves to your server and that Let's Encrypt can validate domain ownership.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746289941027/97507d5a-9bc9-4286-a1ab-518a4f00be08.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746289952622/8a16ab67-6afe-4fc6-a197-5fbe5d545f15.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746289959216/a392bd42-2369-400f-ae24-a9cbba4a48b7.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746289965128/1ddf57a4-3f50-4ea2-9c91-1c2c8ad17817.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746289970292/b176d7a6-c96c-401b-8937-24507ef854e0.png align="center")

## Step-by-Step Setup

### Install Certbot and the Nginx Plugin

First, install Certbot and its Nginx integration plugin:

```plaintext
sudo apt install certbot python3-certbot-nginx
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290059021/4d98ae56-4293-4f16-b453-af768abb9452.png align="center")

### Edit Nginx Server Block

Open your site’s Nginx config:

```plaintext
sudo vi /etc/nginx/sites-available/example.com
```

In the `server` block, make sure to add:

```plaintext
server_name example.com;
```

Nginx needs to know which domain this block is for. This is how Certbot identifies which site to secure.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290167332/6d24e0a8-20b3-4935-a5b4-fba3ea1ec330.png align="center")

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290172233/44f954ad-3a88-4c94-95b5-8e20f163be44.png align="center")

### Test Nginx Config

Check for any syntax errors:

```plaintext
sudo nginx -t
```

Apply your changes:

```plaintext
sudo systemctl reload nginx
```

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290269876/fed00ee2-0517-4043-865b-5cac359053c3.png align="center")

### Obtain and Install SSL Certificate

Now, let’s request the SSL certificate and configure Nginx in one command:

```plaintext
sudo certbot --nginx -d example.com
```

If this is your first time running `certbot`, you will be prompted to enter an email address and agree to the terms of service.

This command will:

* Verify your domain ownership
    
* Download and install the SSL certificate
    
* Automatically configure your Nginx site for HTTPS
    

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290394798/044f92b1-f91a-4a92-9c05-78bc4158c050.png align="center")

### Verifying Everything Works

Certbot sets up an automatic renewal timer. Verify that it's running:

```plaintext
sudo systemctl status certbot.timer
```

Let’s Encrypt certificates expire every 90 days, so automated renewal is critical.

**Test Renewal**

Do a dry-run of the renewal process to ensure it's working:

```plaintext
sudo certbot renew --dry-run
```

This makes sure your renewal process will succeed before it really matters.

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290571693/c1ffcb0d-14ad-4f5e-8573-ff8d7d1bddd9.png align="center")

### Here we go!

![](https://cdn.hashnode.com/res/hashnode/image/upload/v1746290640222/ba5b867e-4893-4422-a512-82dec84becc7.png align="center")

### Conclusion

Securing your website or app with HTTPS is essential for encrypting user data, enhancing trust, and boosting SEO. Let’s Encrypt offers free SSL/TLS certificates via Certbot, simplifying setup with Nginx. The step-by-step guide includes installing Certbot and the Nginx plugin, editing the Nginx server block with your domain, and using Certbot to obtain and install an SSL certificate. Automated renewal ensures certificates stay valid, with verification and renewal testing processes included.