After deploying a webserver, the next essential step is securing traffic between your visitors and your site.

You have just finished building your webserver but your connection is not yet secure. You need to secure traffic between your visitors and your website using connections over HTTPS. HTTPS encrypts data in transit and helps browsers verify that users are connecting to the intended domain.

A straightforward way to enable HTTPS is to purchase an SSL certificate and install it on your server. This tutorial however, will show you a simple way to get that certificate, for free. First, you will learn how to obtain a free TLS/SSL certificate from Let’s Encrypt, and then install and manage it with Certbot.

Let’s Encrypt certificates are trusted by major browsers and can be renewed automatically.

Before you begin, make sure that:

  1.     Your domain’s DNS records already point to your server’s public IP address.
  2.     Your webserver is installed and your website is reachable over HTTP. In my case, I am using Apache as a webserver.
  3.     Ports 80 and 443 are open in your firewall and hosting provider’s network rules.
  4.     You have a user account with sudo privileges

Certbot must be able to reach your server to verify control of the domain before issuing a certificate. The commands you will see below come directly from the Certbot official documentation webpage, which provides current installation instructions for different operating systems and web servers.

Install Certbot with Snap

On many modern Linux distributions, Certbot can be installed through Snap (recommended). First, install or update the Snap core package:

sudo snap install core
sudo snap refresh core

Next, install Certbot

sudo snap install --classic certbot

Create a symbolic link so that the Certbot command is available from the standard system path

sudo ln -s /snap/bin/certbot /usr/bin/certbot

If /usr/bin/certbot already exists, do not overwrite it blindly. Check which version is installed first

which certbot
certbot --version

Request and install the certificate

Once DNS is correctly configured, run Certbot’s Apache installer

sudo certbot --apache

Certbot will guide you through several prompts:

  • Enter an email address for expiry and renewal alerts.
  • Accept the Let’s Encrypt subscriber agreement.
  • Choose whether to receive optional email updates.
  • Select the domain name or virtual host you want to secure.
  • Choose whether Certbot should redirect HTTP traffic to HTTPS.

    For most production websites, select the HTTP-to-HTTPS redirect option. This ensures visitors use the encrypted version of the site automatically. After Certbot completes successfully, visit:

    https://your-domain.com

    You are done. You have an SSL certificate set up on your site. Refresh your website and see the lock sign indicating that your connection is secure.

    Verify automatic renewal

    Let’s Encrypt certificates are short-lived, so automatic renewal matters. Certbot installations commonly configure scheduled renewal, but you should test it:

    sudo certbot renew --dry-run

    A successful test confirms that Certbot can renew your certificate before it expires.

    Common issues

    If, for some reason, this didn’t work, there are things you can do to troubleshoot the problem.

    1. Domain validation fails: Confirm that the domain’s A or AAAA record points to the correct server.
    2. Connection refused: Check that ports 80 and 443 are open.
    3. Wrong virtual host selected: Review your Apache site configuration and rerun Certbot if needed.
    4. Mixed-content warnings: Update any http:// links for scripts, images, style-sheets, or fonts to use HTTPS.