How to Install Certbot on Ubuntu Linux

Install Certbot via Ubuntu repositories

Installing 💿 Certbot from the Ubuntu repositories uses the built-in apt package manager. You don’t need to add any extra software sources. Open your terminal and run sudo apt install certbot to download and set up the program. The method is simple, but the version in the official repositories can be older than the release the developers publish.

If you prefer the Ubuntu repositories, follow these steps. The version you get may not be the latest.

1. Open a terminal. On Ubuntu Desktop, press Ctrl+Alt+T. On a server, connect over SSH.
2. Run the commands below with an account that has sudo rights. You should see apt download and unpack the package, then return to the prompt without errors.

sudo apt install certbot

Run the commands below to check the installed version or remove the package entirely. The version check should print the word certbot followed by a version number. If you get “command not found” instead, the install did not finish.

certbot --version

To uninstall Certbot, run the commands below. Removing the program does not necessarily remove certificates you already issued, so check before you delete anything that a live site still uses.

sudo apt purge certbot && sudo apt autoremove

Install Certbot via the Snap package manager

Installing Certbot with Snap gives you the newest version of the tool, packaged together with everything it needs. Open your terminal and run sudo snap install --classic certbot to set it up. The --classic option is required because Certbot needs to read and write outside the Snap sandbox, for example to edit your web server configuration. Snap also updates the package automatically in the background, so you stay current without doing anything.

If you installed Certbot with apt earlier, remove that version first. Having both installed can lead to confusion about which one runs.

Snap is a universal package format from Canonical. It bundles an application with its dependencies, so the same package works across many Linux distributions. Snap support is included in current Ubuntu releases, which is why the steps below are short.

To install Certbot via Snap, run the command below. When it finishes, the terminal should report that certbot was installed.

sudo snap install --classic certbot

After installing, create a symbolic link from the Certbot Snap location /snap/bin/certbot to /usr/bin/certbot. A symbolic link is a shortcut at the file level. With it in place, you can run the certbot command from any directory without typing the full path.

Run the command below to create that link. It prints nothing when it works. If it complains that the link already exists, the link is already in place and you can move on.

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Now check the installed version. You should see certbot followed by a version number. That confirms the command is found and ready to use.

certbot --version 

With Certbot installed, you can automatically create and renew certificates from the Let's Encrypt Certificate Authority. Let's Encrypt certificates last 90 days, and Certbot is set up to renew them on a schedule, so you don't have to remember the dates yourself.

Before you request anything, check these requirements:

• Your domain name must point to the public IP address of your server.
• Port 80 (HTTP) and port 443 (HTTPS) must be open in your firewall and reachable from the internet. Let's Encrypt connects to your server to confirm you control the domain.
• Nginx or Apache must already be installed and serving your site.

Start with a test certificate to make sure your web server configuration is correct before you ask for a real one. Let's Encrypt limits how many real certificates you can request for a domain in a given period. A failed attempt with a real request can use up part of that limit, so a test run is a safer first step. Browsers do not trust test certificates, so don't leave one on a live site.

To install a test certificate for a Nginx web server, run the command below. If it fails, read the error message. The usual causes are a domain that doesn't point to the server yet or a blocked port 80. Fix that, then run the command again.

sudo certbot --nginx --test-cert

Run the command below to get a valid certificate if the test succeeds. Once it finishes, load your site in a browser using https://. You should see the padlock with no warning.

sudo certbot --nginx

These posts should help you with the next steps, such as creating, revoking and deleting certificates.

• Create a certificate using Certbot for the Apache web server
• Create a certificate using Certbot for the Nginx web server
• Create a wildcard certificate using Certbot
• Revoke and delete a certificate using Certbot

And that's how you install Certbot on Ubuntu.

Conclusion:

• Certbot automates SSL/TLS certificate management on Ubuntu Linux, so you don't have to request and renew certificates by hand.
• You can install Certbot from the Ubuntu repositories (stable, but possibly older) or with the Snap package manager (the more recent version, and the one the developers recommend).
• After installation, you can verify the version, uninstall Certbot if necessary, and create a symbolic link so the certbot command is easy to run.
• Certbot can create and renew certificates from the Let's Encrypt Certificate Authority. Start with a test certificate, then request a valid one for Nginx or Apache.
• The related posts above cover creating, revoking and deleting certificates with Certbot.
• Feedback and additional insights are welcome in the comments form.