SSL and HTTPS: Certbot and Let's Encrypt for secure websites

A secure website is no longer a luxury these days, but a must. With SSL/TLS certificates you encrypt the data traffic between your server and visitors, and HTTPS has become the standard for every professional website. In this article we explain how you can easily request and manage free SSL certificates with Certbot and Let's Encrypt. Whether you are a developer, system administrator, or tech enthusiast: this guide will help you get started.

Why SSL and HTTPS are essential

SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) ensure an encrypted connection between a web server and a browser. This has three important advantages:

• Security: Sensitive data such as login credentials are encrypted
• Authentication: Visitors know for sure they are communicating with the real server
• SEO benefit: Google gives HTTPS websites a higher ranking

Let's Encrypt has made SSL certificates accessible to everyone by offering them for free via an automated process. Certbot is the official client for managing these certificates.

Installing and configuring Certbot

Certbot is the most popular way to request and renew Let's Encrypt certificates. Here is a step-by-step plan for Ubuntu/Debian:

Step 1: Install Certbot

sudo apt update sudo apt install certbot python3-certbot-nginx

For Apache you use python3-certbot-apache instead of the Nginx variant.

Step 2: Request a certificate

For a standard Nginx configuration:

sudo certbot --nginx -d example.com -d www.example.com

Certbot automatically detects your web server configuration and adjusts it for HTTPS. The certificate is automatically renewed every 90 days.

Step 3: Test automatic renewal

Check whether automatic renewal works:

sudo certbot renew --dry-run

Alternatives to Certbot

Although Certbot is the best known, there are alternative ACME clients:

acme.sh - Lightweight shell alternative

For those who prefer working with shell scripts:

curl https://get.acme.sh | sh acme.sh --issue --webroot -w /var/www/html -d example.com

acme.sh has fewer dependencies than Certbot and is suitable for embedded systems.

mkcert - For local development

For development environments where you do not need real certificates:

mkcert -install mkcert example.test

This generates locally trusted certificates without a complex setup.

DNS validation for wildcard certificates

For wildcard certificates (*.example.com) you must use DNS validation. This works with both Certbot and acme.sh:

With Certbot

sudo certbot certonly --manual --preferred-challenges=dns -d *.example.com

With acme.sh

acme.sh --issue --dns dns_cf -d example.com -d *.example.com

This requires API access to your DNS provider (Cloudflare in this example).

Practical tips for SSL management

• Automatic renewal: Make sure certbot renew is in a cronjob
• HTTP/2: Enable HTTP/2 in your web server configuration for better performance
• HSTS: Consider Strict-Transport-Security headers for extra security
• Monitoring: Check certificate expirations with tools such as UptimeRobot
• Backups: Store your certificates and private keys securely

Common problems and solutions

Despite the simplicity, you may run into a few issues:

Rate limits

Let's Encrypt has strict rate limits. For testing, use the staging environment:

certbot --staging ...

Webroot permissions

Make sure the web server has write permissions on the webroot directory for HTTP validation.

Expired certificates

Check regularly whether automatic renewal works. You will find logs in /var/log/letsencrypt/.

Conclusion: SSL accessible to everyone

With Let's Encrypt and tools such as Certbot, managing SSL certificates has never been easier. Within a few minutes you can secure your website with HTTPS, without costs or complex procedures. The main takeaways:

• SSL/TLS is essential for modern websites
• Let's Encrypt offers free certificates
• Certbot is the most widely used client for automation
• Alternatives such as acme.sh exist for specific use cases
• Automatic renewal is crucial for continuity

With this knowledge you can get started right away securing your websites. Do you have questions or tips? Share them in the comments!