TLS certificates with Let's Encrypt - Novogara knowledge base

The quick version

Install certbot from your distribution, then:

certbot --nginx -d example.com -d www.example.com

It proves you control the name, gets the certificate, edits your nginx configuration and sets up renewal. For Apache use --apache; to get the certificate without touching your configuration, use certonly.

Which challenge to use

HTTP-01: The default. Certbot puts a file under /.well-known/acme-challenge/ and the CA fetches it over port 80. Simple, but it needs port 80 open to the world — do not firewall it off because “everything is HTTPS”.
DNS-01: Proves control by adding a TXT record. Slower to set up, but it is the only way to get a wildcard certificate, and it works for machines that are not reachable from the internet at all.

Renewal is the part that fails

Certificates last ninety days. The renewal timer is installed for you, but it can quietly stop working — a changed virtual host, a firewall rule, a redirect that swallows the challenge path. Check that it would succeed before it has to:

certbot renew --dry-run

And confirm the timer is actually active:

systemctl list-timers | grep certbot

The most common cause of a renewal failure is a rule that redirects everything on port 80 to HTTPS, including the challenge path. Exclude /.well-known/acme-challenge/ from that redirect.

Monitor the expiry date

Do not rely on the renewal working silently. Check from outside:

echo | openssl s_client -connect example.com:443 -servername example.com 2>/dev/null | openssl x509 -noout -enddate

Put that in your monitoring with an alert at fourteen days. An expired certificate is one of the few failures that makes a working site completely unusable, and every visitor sees it at once. See monitoring your server.

Worth getting right

Serve the full chain, not just the leaf certificate. Browsers forgive a missing intermediate; many API clients and mobile apps do not.
Enable HSTS once you are confident HTTPS works everywhere, and not before — it is hard to undo.
TLS 1.2 and 1.3 only. Everything older is a liability.
Reload rather than restart after renewal, so connections are not dropped. Certbot's --deploy-hook is the place for it.
Rate limits are real. Let's Encrypt allows a limited number of certificates per domain per week; test against their staging environment while you are experimenting.

When you need a paid certificate

Rarely. The encryption is identical. You pay for organisation validation, a warranty and a support contract — which some compliance regimes and some customers require. If nobody is asking for it, Let's Encrypt is the right default.

Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base