Skip to content
Follow
Ubuntu Linux

Generate Free Let’s Encrypt SSL on Ubuntu 24.04

Richard
Written by
Richard
Updated 11 min read
Generate Free Let’s Encrypt SSL on Ubuntu 24.04
Generate Free Let’s Encrypt SSL on Ubuntu 24.04
A Let’s Encrypt SSL certificate on Ubuntu 24.04 turns your website’s plain HTTP address into a secure HTTPS connection. This free security tool encrypts all data sent between your server and visitors, so outsiders cannot read passwords or personal details in transit. Certbot is the official command-line tool that requests and installs these certificates on your Linux server. Each certificate lasts for 90 days, but Certbot sets up automatic renewals so your site stays secure without any extra work from you.
⚡ Quick Answer

Generate a free Let’s Encrypt SSL certificate on Ubuntu 24.04 by installing Certbot with sudo apt install certbot, then running sudo certbot certonly –webroot -w /var/www/html -d srv1.example.com with your own domain. Confirm the domain’s DNS A record points to your server and port 80 is open first. Your web server keeps running during the process.

Advertisement

Install Certbot Client

The Certbot client is a tool that automates the certificate process for Let’s Encrypt on Linux systems. It proves to Let’s Encrypt that you control the domain, downloads the certificate and saves it on your server. It also sets up the renewal job for you. Run the command below to install it. You need a user account with sudo rights, and the server needs internet access to download the package.
🐧Bash / Shell
sudo apt update
sudo apt install certbot
With the tool now installed, you can generate certificates for your server. Before you do, check that the domain’s DNS A record (and AAAA record, if you use IPv6) points to this server’s public IP address. Let’s Encrypt validates the domain over the internet, so a wrong or missing DNS record is the most common reason a request fails.

Generate a certificate with a web server

You can generate a Let’s Encrypt SSL certificate on Ubuntu 24.04 while an active web server such as Apache or Nginx is running. This is the webroot method. Certbot places a small validation file in your site’s web folder, and Let’s Encrypt fetches it over port 80 to confirm you own the domain. Your web server is not stopped, so there is no downtime. The short version is to make sure your server is reachable from the internet on port 80, then run sudo certbot certonly –webroot -w /var/www/html -d srv1.example.com, replacing the domain with your own. The sections below explain each part. You must ensure that the server is accessible via port 80 for Let’s Encrypt verification from the Internet. Check these three things before you continue:
  1. Confirm that any firewall on the server allows inbound traffic on port 80.
  2. If the server is in a cloud platform, confirm that the provider’s security group or network firewall also allows port 80.
  3. Confirm that your web server is running and answering on the domain you want to secure.
The command to generate a certificate is below, assuming a web server is installed. Change the folder after -w if your site lives somewhere other than the default web folder, and change the domain after -d to your own.
🐧Bash / Shell
sudo certbot certonly --webroot -w /var/www/html -d srv1.example.com
The command options:
    • –webroot ==>[use a directory under webroot] .
    • -w /var/www/html ==>[working directory] .
    • -d ==> srv1.example.com[fully qualify server hostname] .
When you press the Enter key, Certbot asks a few questions the first time you run it. You will see prompts similar to the ones below.
  1. Enter an email address when asked. Let’s Encrypt uses it for expiry warnings and important account notices.
  2. Read and agree to the terms of service.
  3. Choose whether to share your email with the Electronic Frontier Foundation. This is optional, and you can decline.
Advertisement
Certbot then contacts Let’s Encrypt and validates the domain. If it succeeds, it prints a success message and tells you where the files were saved.
💻Code
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Enter email address (used for urgent renewal and security notices)
# for only initial using, register your email address and agree to terms of use
# specify valid email address
 (Enter 'c' to cancel): admin@example.com

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
agree in order to register with the ACME server. Do you agree?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
# agree to the terms of use
(Y)es/(N)o: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing, once your first certificate is successfully issued, to
EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: A
Account registered.
Requesting a certificate for srv1.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/srv1.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/srv1.example.com/privkey.pem
This certificate expires on 2025-03-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.
...........
...........
After generating your free SSL certificates, they will be stored at the location provided with the fully qualified server hostname. [/etc/letsencrypt/live//] That folder holds the certificate chain (fullchain.pem) and the private key (privkey.pem). Keep the private key secret and never share it or post it publicly. Because we used certonly, Certbot only fetched the certificate. It did not change your web server’s configuration, so you still need to point Apache or Nginx at these files and reload the service.

Generate a certificate without a web server

You can generate a Let’s Encrypt SSL certificate on Ubuntu 24.04 without running a web server by using standalone mode. Certbot starts a temporary web server of its own to answer the validation request, then shuts it down.
  1. Stop any service that is using port 80, such as Apache or Nginx. Certbot cannot start its temporary server if the port is already taken.
  2. Run sudo certbot certonly –standalone -d srv1.example.com, replacing the domain with your actual server address.
  3. Start your web service again once Certbot has finished.
The server must still be accessible from the internet on port 80 even without a web server. The same firewall, cloud security group and DNS checks apply as in the webroot method. The command to do that is below. You will get the same email and terms-of-service prompts as before if this is the first certificate you request on this server.
🐧Bash / Shell
sudo certbot certonly --standalone -d srv1.example.com
The command options:
    • –standalone ==>[use web server features] .
    • -d ==> srv1.example.com[fully qualify server hostname] .
If the command is successful, you will see a message similar to the one below. It confirms that the certificate was issued, shows where the files are saved, and gives the expiry date.
💻Code
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Requesting a certificate for srv1.example.com

Successfully received certificate.
Certificate is saved at: /etc/letsencrypt/live/srv1.example.com/fullchain.pem
Key is saved at:         /etc/letsencrypt/live/srv1.example.com/privkey.pem
This certificate expires on 2025-03-10.
These files will be updated when the certificate renews.
Certbot has set up a scheduled task to automatically renew this certificate in the background.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Your free SSL certificates should be ready to use. If the request fails instead, read the error text. It usually points to one of three causes: a DNS record that does not match the server, port 80 blocked by a firewall, or another service still using port 80. Let’s Encrypt also limits how many certificates you can request in a short time, so avoid repeating failed requests many times in a row.

Renewal

Let’s Encrypt SSL certificates on Ubuntu 24.04 renew automatically because Certbot installs a background timer during setup. You do not need to perform manual renewals for your domains. Certbot checks regularly and only renews certificates that are close to expiry, so most of its runs do nothing. To verify that the timer is active, run the command systemctl status certbot.timer in your terminal and check the schedule it shows. There’s nothing to do, it should automatically renew your certificates. One thing to watch: a certificate issued in standalone mode needs port 80 free when it renews. If your web server uses that port, the renewal can fail, so plan for that if you chose the standalone method on a server that also runs a web service. Run the command below to check the timer’s status.
💻Code
systemctl status certbot.timer
You should see something similar to the one below. Look for active (waiting), which means the timer is enabled and waiting for its next run, along with the time of the next scheduled trigger.
💻Code
*  certbot.timer - Run certbot twice daily
     Loaded: loaded (/usr/lib/systemd/system/certbot.timer; enabled; preset: en>
     Active: active (waiting) since Mon 2025-03-10 10:13:26 UTC; 1min 17s ago
    Trigger: Tue 2025-03-20 10:21:37 UTC; 14h left
   Triggers: *  certbot.service
To manually renew the certificates, run the command below. This is useful for testing, or if you want to renew right away. Certbot skips any certificate that is not yet due for renewal, so running it early is safe.
🐧Bash / Shell
sudo certbot renew
To convert certificates to PKCS12 (PFX) format for Windows and other systems, run the command below. The PFX file bundles the certificate and its private key into one file, which is the format Windows and IIS expect. If the command asks for an export password, choose a strong one, and store the finished file securely because it contains your private key. Converting does not change the original files, and you will need to repeat the conversion after each renewal if you use the PFX elsewhere.
🐧Bash / Shell
sudo openssl pkcs12 -export -in fullchain.pem -inkey privkey.pem -out srv1.example.com.pfx
That should do it! Conclusion: In summary, generating a free Let’s Encrypt SSL certificate on Ubuntu 24.04 is a straightforward process that enhances your website’s security. Here are the key points to remember:
    • Free Service: Let’s Encrypt provides cost-free SSL/TLS certificates to improve internet security.
Advertisement
    • Automated Renewal: Certbot automates the certificate renewal process, ensuring your site remains secure without manual intervention.
    • Flexible Options: Certificates can be generated with or without an existing web server, offering flexibility based on your server setup.
    • Scheduled Tasks: Certbot creates system timers to manage the automatic renewal of certificates with minimal user input.
    • PKCS12 Conversion: Certificates can be converted to different formats, such as PKCS12 (PFX), for wider compatibility across various systems.
By following the outlined steps, you can successfully secure your website with HTTPS, creating a safer online experience for your visitors. Remember that port 80 must stay reachable from the internet, because Let's Encrypt needs it both for the first request and for every renewal.

Frequently asked questions

How generate ca signed ssl certificate with let's encrypt on Ubuntu24?

Install Certbot with sudo apt install certbot, then run sudo certbot --nginx -d yourdomain.com if you use Nginx. Certbot requests a certificate from Let's Encrypt, a free certificate authority, and installs it for you. Your domain's DNS record must point to the server, and ports 80 and 443 must be open. Certificates last 90 days and renew automatically.

How to get free ssl lets encrypt Ubuntu?

You get a free certificate from Let's Encrypt by installing Certbot and running it with your domain name. Let's Encrypt charges nothing, but it checks that you control the domain first, usually by reaching your server on port 80. Certbot then downloads the certificate and can install it into Nginx or Apache. Certbot renews it automatically before it expires.

How to set up ssl certificate on Ubuntu using letsencrypt?

Install Certbot, then run sudo certbot --nginx -d yourdomain.com, replacing the domain with yours and using --apache if Apache is your web server. Certbot proves you control the domain, downloads the certificate, and updates your site settings. When asked, choose the option to redirect HTTP to HTTPS. Finally, run sudo certbot renew --dry-run to confirm automatic renewal works.

How to install certbot Ubuntu?

Run sudo apt update to refresh the package list, then run sudo apt install certbot. Enter your password when asked, and type Y to confirm if prompted. Certbot is the official command-line tool for getting Let's Encrypt certificates. Check the install by running certbot --version, which prints the installed version number.

How to install aider chat inside Ubuntu 18.04 container?

Ubuntu 18.04 ships with Python 3.6, which is too old for aider-chat. Install a newer Python, such as 3.10 from the deadsnakes PPA, then run python3.10 -m venv aider-env and pip install aider-chat inside that environment. The simpler route is a container based on Ubuntu 22.04 or 24.04, where the default Python works.

Still have a question?

Answered by AI from this guide. Good questions may be added to this page — please don't include personal details.

Advertisement
Tags: #Ubuntu Linux

Did this guide fix your problem?

Richard

About the Author

Richard

Tech Writer, IT Professional

Richard is a writer at Geek Rewind who turns complex IT tasks into clear, step-by-step guides. He draws on years of hands-on experience in system administration and enterprise IT operations, focusing on Windows, Linux and WordPress: the problems people actually run into, and the fixes that work. His server and WordPress guides come from systems he runs himself. Richard builds and maintains the platform behind Geek Rewind, from its Ubuntu servers and Nginx configuration to its custom WordPress plugins. Many new tutorials start with readers' questions, and he's always glad to answer them in the comments.

Advertisement

2 Comments

Leave a Comment

Your email address will not be published. Required fields are marked *