Generate Free Let’s Encrypt SSL on Ubuntu 24.04

Install Certbot Client

The Certbot client is a tool that automates the certificate process for Let’s Encrypt on Linux systems. It proves to Let’s Encrypt that you control the domain, downloads the certificate and saves it on your server. It also sets up the renewal job for you.

Run the command below to install it 💿. You need a user account with sudo rights, and the server needs internet access to download the ⬇️ package.

sudo apt update
sudo apt install certbot

Before you do, check that the domain’s DNS A record (and AAAA record, if you use IPv6) points to this server’s public IP address. Let’s Encrypt validates the domain over the internet, so a wrong or missing DNS record is the most common reason a request fails.

Generate a certificate with a web server

You can generate a Let’s Encrypt SSL certificate on Ubuntu 24.04 while an active web server such as Apache or Nginx is running. This is the webroot method. Certbot places a small validation file in your site’s web folder, and Let’s Encrypt fetches it over port 80 to confirm you own the domain. Your web server is not stopped, so there is no downtime.

The short version is to make sure your server is reachable from the internet on port 80, then run sudo certbot certonly –webroot -w /var/www/html -d srv1.example.com, replacing the domain with your own. The sections below explain each part.

You must ensure that the server is accessible via port 80 for Let’s Encrypt verification from the Internet. Check these three things before you continue:

1. Confirm that any firewall on the server allows inbound traffic on port 80.
2. If the server is in a cloud platform, confirm that the provider’s security group or network firewall also allows port 80.
3. Confirm that your web server is running and answering on the domain you want to secure.

The command to generate a certificate is below, assuming a web server is installed. Change the folder after -w if your site lives somewhere other than the default web folder, and change the domain after -d to your own.

sudo certbot certonly --webroot -w /var/www/html -d srv1.example.com

The command options:

• –webroot ==> [use a directory under webroot] .
• -w /var/www/html ==> [working directory] .
• -d ==> srv1.example.com [fully qualify server hostname] .

When you press the Enter key, Certbot asks a few questions the first time you run it. You will see prompts similar to the ones below.

1. Enter an email address when asked. Let’s Encrypt uses it for expiry warnings and important account notices.
2. Read and agree to the terms of service.
3. Choose whether to share your email with the Electronic Frontier Foundation. This is optional, and you can decline.

Certbot then contacts Let’s Encrypt and validates the domain. If it succeeds, it prints a success message and tells you where the files were saved.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
# for only initial using, register your email address and agree to terms of use
# specify valid email address
 (Enter 'c' to cancel): admin@example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# agree to the terms of use
(Y)es/(N)o: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: A
Account registered.
Requesting a certificate for srv1.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/srv1.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/srv1.example.com/privkey.pem
This certificate expires on 2025-03-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
...........
...........

After generating your free SSL certificates, they will be stored at the location provided with the fully qualified server hostname. [/etc/letsencrypt/live/ [[SAL_FIXED_118]] /]

That folder holds the certificate chain (fullchain.pem) and the private key (privkey.pem). Keep the private key secret and never share it or post it publicly. Because we used certonly, Certbot only fetched the certificate. It did not change your web server’s configuration, so you still need to point Apache or Nginx at these files and reload the service.

Generate a certificate without a web server

You can generate a Let’s Encrypt SSL certificate on Ubuntu 24.04 without running a web server by using standalone mode. Certbot starts a temporary web server of its own to answer the validation request, then shuts it down.

1. Stop any service that is using port 80, such as Apache or Nginx. Certbot cannot start its temporary server if the port is already taken.
2. Run sudo certbot certonly –standalone -d srv1.example.com, replacing the domain with your actual server address.
3. Start your web service again once Certbot has finished.

The server must still be accessible from the internet on port 80 even without a web server. The same firewall, cloud security group and DNS checks apply as in the webroot method.

The command to do that is below. You will get the same email and terms-of-service prompts as before if this is the first certificate you request on this server.

sudo certbot certonly --standalone -d srv1.example.com

The command options:

• –standalone ==> [use web server features] .
• -d ==> srv1.example.com [fully qualify server hostname] .

If the command is successful, you will see a message similar to the one below. It confirms that the certificate was issued, shows where the files are saved, and gives the expiry date.

Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for srv1.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/srv1.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/srv1.example.com/privkey.pem
This certificate expires on 2025-03-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Your free SSL certificates should be ready to use. If the request fails instead, read the error text. It usually points to one of three causes: a DNS record that does not match the server, port 80 blocked by a firewall, or another service still using port 80. Let’s Encrypt also limits how many certificates you can request in a short time, so avoid repeating failed requests many times in a row.

Renewal

Let’s Encrypt SSL certificates on Ubuntu 24.04 renew automatically because Certbot installs a background timer during setup. You do not need to perform manual renewals for your domains. Certbot checks regularly and only renews certificates that are close to expiry, so most of its runs do nothing. To verify that the timer is active, run the command systemctl status certbot.timer in your terminal and check the schedule it shows.

There’s nothing to do, it should automatically renew your certificates. One thing to watch: a certificate issued in standalone mode needs port 80 free when it renews. If your web server uses that port, the renewal can fail, so plan for that if you chose the standalone method on a server that also runs a web service.

Run the command below to check the timer’s status.

systemctl status certbot.timer

You should see something similar to the one below. Look for active (waiting), which means the timer is enabled and waiting for its next run, along with the time of the next scheduled trigger.

*  certbot.timer - Run certbot twice daily
     Loaded: loaded (/usr/lib/systemd/system/certbot.timer; enabled; preset: en>
     Active: active (waiting) since Mon 2025-03-10 10:13:26 UTC; 1min 17s ago
    Trigger: Tue 2025-03-20 10:21:37 UTC; 14h left
   Triggers: *  certbot.service

To manually renew the certificates, run the command below. This is useful for testing, or if you want to renew right away. Certbot skips any certificate that is not yet due for renewal, so running it early is safe.

sudo certbot renew

The PFX file bundles the certificate and its private key into one file, which is the format Windows and IIS expect. If the command asks for an export password, choose a strong one, and store the finished file securely because it contains your private key. Converting does not change the original files, and you will need to repeat the conversion after each renewal if you use the PFX elsewhere.

sudo openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out srv1.example.com.pfx

That should do it!

Conclusion:

In summary, generating a free Let's Encrypt SSL certificate on Ubuntu 24.04 is a straightforward process that enhances your website's security. Here are the key points to remember:

• Free Service: Let's Encrypt provides cost-free SSL/TLS certificates to improve internet security.
• Automated Renewal: Certbot automates the certificate renewal process, ensuring your site remains secure without manual intervention.
• Flexible Options: Certificates can be generated with or without an existing web server, offering flexibility based on your server setup.
• Scheduled Tasks: Certbot creates system timers to manage the automatic renewal of certificates with minimal user input.
• PKCS12 Conversion: Certificates can be converted to different formats, such as PKCS12 (PFX), for wider compatibility across various systems.

By following the outlined steps, you can successfully secure your website with HTTPS, creating a safer online experience for your visitors. Remember that port 80 must stay reachable from the internet, because Let's Encrypt needs it both for the first request and for every renewal.