Set up Nginx with free SSL using Let's Encrypt

Every website should serve over HTTPS. It encrypts traffic, is required by browsers to avoid "Not Secure" warnings, and is a ranking signal. Thanks to Let's Encrypt it's also completely free. Here's how to set up Nginx with an auto-renewing certificate.

Prerequisites

• A VPS with a public IP (Ubuntu or Debian here).
• A domain name with an A record pointing at your server's IP. The certificate authority verifies you control the domain, so DNS must resolve first.
• Ports 80 and 443 open.

Step 1: Install Nginx

sudo apt update
sudo apt install nginx -y

Allow web traffic through the firewall:

sudo ufw allow 'Nginx Full'
sudo ufw allow OpenSSH
sudo ufw enable

Visit http://YOUR_SERVER_IP and you should see the Nginx welcome page.

Step 2: Configure a server block for your domain

Create /etc/nginx/sites-available/example.com:

server {
    listen 80;
    server_name example.com www.example.com;
    root /var/www/example.com/html;
    index index.html;

    location / {
        try_files $uri $uri/ =404;
    }
}

Create the web root and a test page:

sudo mkdir -p /var/www/example.com/html
echo "<h1>Hello from example.com</h1>" | sudo tee /var/www/example.com/html/index.html

Enable the site and reload:

sudo ln -s /etc/nginx/sites-available/example.com /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Step 3: Install Certbot

Certbot is the tool that talks to Let's Encrypt, obtains the certificate, and edits Nginx for you:

sudo apt install certbot python3-certbot-nginx -y

Step 4: Obtain and install the certificate

Run Certbot with the Nginx plugin:

sudo certbot --nginx -d example.com -d www.example.com

You'll enter an email (for expiry warnings) and agree to the terms. Certbot then:

1. Proves you control the domain via an HTTP challenge on port 80.
2. Downloads a valid certificate.
3. Rewrites your server block to listen on 443 with the certificate.
4. Sets up an automatic redirect from HTTP to HTTPS.

Visit https://example.com — you now have a padlock and a valid certificate.

Step 5: Confirm automatic renewal

Let's Encrypt certificates last 90 days, but Certbot installs a timer to renew them automatically. Test that the renewal process works:

sudo certbot renew --dry-run

If it reports success, you never have to think about expiry again.

A stronger TLS configuration

For a better security grade, Certbot already applies sensible defaults, but you can add HSTS to tell browsers to always use HTTPS. Inside the server block that listens on 443:

add_header Strict-Transport-Security "max-age=63072000; includeSubDomains" always;

Reload after any change:

sudo nginx -t && sudo systemctl reload nginx

Troubleshooting

• Challenge failed — DNS isn't pointing at the server yet, or port 80 is blocked. Confirm the A record and firewall.
• Too many certificates — Let's Encrypt rate-limits repeated issuance; use --dry-run while testing.
• Site still shows "Not Secure" — clear the cache; check that the 443 server block loaded with sudo nginx -t.

The result

In a few minutes you've gone from plain HTTP to a properly encrypted, auto-renewing HTTPS site at no cost. On a Nxeon NVMe VPS with full root, this whole flow takes about as long as reading this guide — and every site you host afterward follows the same three steps: server block, Certbot, done.