Certbot Installation and Configuration(Ubuntu)

1. Installation:

   Begin by updating your package list and installing Certbot using the following commands:

   

   sudo apt update

   sudo apt install certbot python3-certbot-nginx

 

2. Configuring Certbot for Nginx:

   Certbot offers automated Nginx configuration. Execute the command below to acquire and install a certificate. Certbot will seamlessly modify your Nginx configuration to enable HTTPS:

   

   sudo certbot –nginx

   

   Certbot will lead you through the process, prompting for the domain names you wish to secure. It will then handle the automatic configuration of your Nginx server block(s) with the new certificate.

   > Note: If opting for the standalone method (not recommended if Nginx is already active), replace '--nginx' with '--standalone'.

 

3. Certificate Renewal:

   Certificates issued by Certbot have a 90-day lifespan. Automate the renewal process with a cron job that efficiently renews certificates nearing expiration. Certbot ensures that only certificates due for renewal are processed.

   

   To create the cron job, enter the following command:

   

   sudo crontab -e

   

   Insert this line into the crontab configuration to renew certificates daily at midnight:

   

   0 0    /usr/bin/certbot renew

   

   The crontab format follows:

 

    * * * * * command(s)

    - - - - -

    | | | | |

    | | | | ----- Day of week (0 - 7) (Sunday=0 or 7)

    | | | ------- Month (1 - 12)

    | | --------- Day of month (1 - 31)

    | ----------- Hour (0 - 23)

    ------------- Minute (0 - 59)

 

   Certbot exclusively renews certificates within 30 days of expiration, ensuring the safety of daily renewal execution.

 

4. Domain and Email Configuration:

   When obtaining the certificate, customize your domain and email settings using this command:

 

   sudo certbot certonly -d example.com --standalone -m your@email.com --agree-tos -n --no-eff-email

 

   Replace 'example.com' with your actual domain and 'your@email.com' with your email address. The '--no-eff-email' flag prevents email addresses from being included in the EFF's email obfuscation database.

 

5. Nginx Reload or Restart:

   After acquiring or renewing certificates, apply the changes by reloading or restarting Nginx:

   

 

   sudo systemctl reload nginx

   

By following these steps, you can successfully install Certbot, configure it for Nginx, secure your domain, and establish automated SSL certificate renewal on an Ubuntu server.