Free SSL : How to Install Let’s Encrypt on Ubuntu, Nginx

We will use apt based client tool to install the certificate. So, it is just easy. Previously, we have written about Let’s Encrypt Project. Here is Step by Step Commands to Use Free SSL by Let’s Encrypt Project. This is How to Install Let’s Encrypt on Ubuntu, Nginx for WordPress. You’ll get A+ on SSL Lab’s test with this method.

Read Before You are Going to Install Let’s Encrypt on Ubuntu, Nginx

For those who have an existing SSL certificate, they can use a subdomain to test or use the 301 redirected www subdomain. We are writing for Ubuntu 16.04 LTS, hence we will use apt-get install letsencrypt command to perform the works. There is separate thing – an agent software for Let’s Encrypt. Which is not present in case of paid SSL certificates. There are two modes for configuration. First is standalone, which replaces the web server to respond to ACME (Automatic Certificate Management Environment) challenges. Second is webroot. Where your web server to serve challenges from a known directory. Both of these are for when you do not want the certbot to edit your file. certbot is Let’s Encrypt client software. We are using webroot because it does not need replace Nginx bind to port 80 in order to renew certificates.

In this guide on how to install Let’s Encrypt on Ubuntu, Nginx; we are setting up abhishekghosh.pro to be served from /usr/share/nginx/html and challenges will be served from /usr/share/nginx/html/letsencrypt/. This is the official GitHub repo profile of Let’s Encrypt’s agent :

Here is Automatic Certificate Management Environment (ACME) specification :

We often give examples with acme.com as domain. What is this acme? Read on acme.com. That ACME is a group since 1970s promoting UNIX freeware.

Steps of How to Install Let’s Encrypt on Ubuntu, Nginx

We are taking it granted that you have installed Nginx. Create a file for SSL configuration named /etc/nginx/snippets/ssl.conf with this content :

Now create a file named /etc/nginx/snippets/letsencrypt.conf with this content :

We said that challenges will be served from /usr/share/nginx/html/letsencrypt/ location. That is what will the above stuff will do. We need the directory. Create it :

Your Nginx virtual host file equivalent is /etc/nginx/sites-enabled/default. Edit it :

The above is for HTTP, not HTTPS. Now install the client :

Copy this command, edit it and run :

It will save the files in /etc/letsencrypt/live/www.abhishekghosh.pro/. cd to that directory and run :

Now, this is an example full /etc/nginx/sites-enabled/default configuration with default nginx locations and domain abhishekghosh.pro :

Run nginx config test :

Restart nginx :

You can renew using the command letsencrypt renew. You can set a cron to run the command every 15 or 30 days.
Of course, you can print this and check mark the steps after doing, in case you are getting confused :