Secure Website with Let's Encrypt on Ubuntu

Prerequisites

To complete this guide, you will need:

Both of the following DNS records set up for your server. You can follow this hostname tutorial for details on how to add them.
- An A record with example.com pointing to your server’s public IP address.
- An A record with www.example.com pointing to your server’s public IP address.
Nginx installed by following How To Install Nginx on Ubuntu 18.04.
(OR)
Apache installed by following How To Install Apache on Ubuntu 18.04.

1. Installing Certbot

sudo apt-get update
#For Nginx
sudo apt-get install python3-certbot-nginx 

#For Apache
sudo apt-get install python3-certbot-apache

2. Set Up the SSL Certificate on Nginx

vi /etc/nginx/sites-available/default

Find the existing server_name line and replace the underscore, _, with your domain name:

Obtaining an SSL Certificate on Nginx

certbot --nginx -d example.com -d www.example.com

3. Set Up the SSL Certificate on Apache

vi /etc/apache2/sites-available/your_domain.conf

Find the existing ServerName line. It should look like this:

Obtaining an SSL Certificate on Apache

certbot --apache -d example.com -d www.example.com

4. Verifying Certbot Auto-Renewal

Let’s Encrypt certificates only last for 90 days.

To test the renewal process, you can do a dry run with certbot:

Copy

certbot renew --dry-run

If you want to run certbot renew with daily schedule,

sudo crontab -l
sudo crontab -e

# Edit this file to introduce tasks to be run by cron.
# m h  dom mon dow   command

0 0 * * *  root certbot renew --renew-hook 'service apache2 reload'
0 0 * * *  root certbot renew --renew-hook 'service nginx reload'

5. Generating The Wildcard SSL Certificate

sudo certbot certonly --manual   --preferred-challenges=dns   --email [email protected]   --server https://acme-v02.api.letsencrypt.org/directory   --agree-tos   --manual-public-ip-logging-ok   -d *.test.com

IMPORTANT NOTES:
Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/test/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/test/privkey.pem
Your cert will expire on 2021-09-06. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew all of your certificates, run
"certbot renew"
If you like Certbot, please consider supporting our work by:
Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate Donating to EFF: https://eff.org/donate-le