You should install and configure nginx before running Certbot. Nginx must be listening on port 80 to handle the ACME HTTP-01 challenge that Certbot uses to prove domain ownership. If nginx is not already active, the certificate issuance process will fail because the validation server cannot reach your web root.
Understanding the Roles of Each Tool
To understand why the order matters, it helps to look at what each piece of software actually does during an SSL setup. Nginx is a high-performance HTTP server and reverse proxy. Its primary job in this context is to serve files from your disk and forward requests to backend applications. It also handles the TLS termination, meaning it decrypts incoming HTTPS traffic so your application can process plain HTTP.
Certbot, on the other hand, is a client for the Let's Encrypt Certificate Authority. It automates the process of obtaining and renewing SSL/TLS certificates. When you run
certbot certonly --nginx, it temporarily modifies your nginx configuration to redirect specific URLs to a hidden directory. This allows Let's Encrypt to verify that you control the domain. Once verification succeeds, Certbot retrieves the certificate files and updates your nginx configuration again to use them for encrypted connections.
If you attempt to run Certbot before nginx is installed or configured, the tool has no way to communicate with the ACME server via the HTTP protocol. The validation fails immediately, leaving you without a certificate. Therefore, the infrastructure must exist before the automation tool can interact with it.
Prerequisites Before Installation
Before installing either tool, ensure you have a non-root user with sudo privileges and a domain name pointing to your server's IP address. You need a basic firewall configuration that allows traffic on ports 80 (HTTP) and 443 (HTTPS). While we are setting up nginx first, you only need port 80 open initially. Port 443 can remain closed until after the certificate is successfully obtained and configured.
Step-by-Step Installation Order
Follow these steps strictly to avoid common pitfalls during the SSL setup process.
- Install Nginx: Use your system package manager to install nginx. For example, on Ubuntu or Debian, run
sudo apt update followed by sudo apt install nginx. On CentOS or RHEL, use yum install nginx.
- Start and Enable Nginx: Ensure the service is running and starts automatically on boot. Run
sudo systemctl start nginx and sudo systemctl enable nginx.
- Create a Basic Server Block: Create a simple configuration file in
/etc/nginx/sites-available/. Define a server block that listens on port 80 and sets a root directory for your website. You do not need to configure SSL yet.
- Test the Configuration: Always test your nginx syntax before reloading. Run
sudo nginx -t. If the test passes, reload the service with sudo systemctl reload nginx.
- Verify HTTP Access: Open a browser and navigate to
http://yourdomain.com. You should see the default nginx welcome page or your content. This confirms that nginx is serving files correctly.
- Install Certbot: Now that nginx is ready, install the certbot package. On many systems, you can install it via
apt install certbot or by using the Snap package manager if available.
- Run Certbot: Execute
sudo certbot --nginx -d yourdomain.com. Certbot will detect the existing nginx installation, modify the config to allow the challenge, obtain the certificate, and then reconfigure nginx for HTTPS.
Common Pitfalls and Troubleshooting
Many users encounter issues when they try to force HTTPS too early. If you configure nginx to listen only on port 443 before having a valid certificate, the server may refuse connections or return errors. Certbot needs the ability to write to the nginx configuration files. Ensure your user has the necessary permissions or run commands with
sudo.
Another frequent error occurs if the domain DNS records are not propagated. Let's Encrypt servers must be able to resolve your domain name to your public IP address. If you recently changed DNS settings, wait for propagation before running Certbot. You can check this using tools like
dig or online DNS checkers.
Firewall rules are another critical component. If you are using
ufw or
firewalld, ensure that port 80 is explicitly allowed. A blocked port 80 prevents the ACME challenge from completing, causing Certbot to abort the process. After successful certificate installation, you can safely restrict access to port 80 if you wish to enforce HTTPS, but leave it open during the initial setup.
For more details on handling connection errors during this phase, you might find our guide on
Client Fails TLS Handshake: Troubleshooting Guide helpful. It covers various scenarios where network configurations interfere with secure connections.
Post-Installation Verification
Once Certbot finishes, verify that everything is working correctly. Check the nginx configuration again with
sudo nginx -t to ensure no syntax errors were introduced. Reload the service to apply changes. Visit your site using
https:// and look for the padlock icon in your browser. You can also use online SSL testing tools to verify the certificate chain and expiration date.
Remember that Let's Encrypt certificates expire every ninety days. Certbot includes a renewal mechanism that runs automatically via cron or systemd timers. Test this renewal process periodically with
sudo certbot renew --dry-run to ensure your site remains secure without manual intervention.
Frequently Asked Questions
Can I use Certbot without nginx?
Yes, Certbot supports multiple web servers including Apache, HAProxy, and standalone mode. However, if you are using nginx, the
--nginx plugin simplifies the configuration process significantly by handling the edits automatically.
What happens if the DNS is not propagated?
Let's Encrypt will fail to validate your domain because it cannot reach your server over port 80. You must wait for DNS propagation to complete before attempting to obtain a certificate.
Do I need to restart nginx after Certbot runs?
Certbot typically reloads nginx automatically after modifying the configuration files. However, if you encounter issues, manually running
sudo systemctl reload nginx ensures the new settings are applied.
Why does my site show a security warning after setup?
This often happens if the certificate is not correctly linked in the nginx configuration or if there is a mismatch between the domain name and the certificate. Verify that the
ssl_certificate and
ssl_certificate_key paths point to the correct files.
Is it safe to keep port 80 open permanently?
While keeping port 80 open allows for automatic redirection to HTTPS, you can close it if you only want to serve HTTPS traffic. However, closing it prevents future automated renewals unless you use a different validation method like DNS-01.