Introduction
Let’s Encrypt is a free Certificate Authority (CA) that issues TLS certificates to encrypt the connection between a browser and a web server. Certbot is an ACME client used to request, install, and automatically renew certificates. With the Apache plugin, Certbot can find the appropriate VirtualHost, add the TLS configuration, and reload Apache after installation (according to the Ubuntu Server documentation).
In this guide, you will use Certbot to obtain a free certificate for Apache on Ubuntu 22.04 or Ubuntu 24.04, configure HTTPS, and test automatic renewal.
This article uses a separate VirtualHost file for the website instead of editing Apache’s default configuration. This approach gives each domain an independent configuration while preserving the default configuration as a fallback.
Prerequisites
To follow this guide, you need:
- An Ubuntu 22.04 or Ubuntu 24.04 server with a non- rootuser, administrative access through
sudo, and a configured firewall. You can refer to the Ubuntu server setup guide. - A registered domain. In this article, the example domain is
your_domain. - DNS records pointing to the server’s public IP address:
- An A record for
your_domain. - An A record for
www.your_domain.
- An A record for
- Apache installed with a VirtualHost for the domain, such as
/etc/apache2/sites-available/your_domain.conf. See also how to install Apache on Ubuntu. - TCP port
80must be accessible from the Internet during HTTP-01 validation; port443must be open so users can access HTTPS (according to the Ubuntu Server documentation).
Step 1 — Install Certbot
Certbot can be installed from several sources. For modern Ubuntu releases, the Ubuntu documentation recommends installing Certbot from Snap to receive a version updated independently of the APT package cycle.
If Snap is not yet installed on the server, install snapdit:
sudo apt update
sudo apt install snapdThen install Certbot and create a command symlink in /usr/bin:
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -s /snap/bin/certbot /usr/bin/certbotIf Certbot was previously installed from APT, consider removing the old version before switching to Snap to avoid command and renewal mechanism conflicts:
sudo apt remove certbot python3-certbot-apacheCheck the installed version:
certbot --versionStep 2 — Check Apache VirtualHost Configuration
To automatically obtain and install a certificate, Certbot must find the correct VirtualHost in the Apache configuration. The domain name is taken from the ServerName and ServerAlias directives in the VirtualHostblock.
Open the domain’s VirtualHost file:
sudo nano /etc/apache2/sites-available/your_domain.confMake sure the file contains similar lines:
/etc/apache2/sites-available/your_domain.conf
...
ServerName your_domain
ServerAlias www.your_domain
...If you have just changed the configuration, check the syntax:
sudo apache2ctl configtestThe expected result is Syntax OK. If there are no errors, reload Apache:
sudo systemctl reload apache2Check that the VirtualHost is enabled and Apache is listening on the required ports:
sudo a2ensite your_domain.conf
sudo apache2ctl -SStep 3 — Open HTTP and HTTPS on the Firewall
If you use UFW, allow SSH, HTTP, and HTTPS. Do not close port 80 before completing certificate issuance, because Let’s Encrypt’s HTTP-01 method needs to access the server through this port. UFW is the default firewall tool on Ubuntu (according to the Ubuntu Server documentation).
sudo ufw status
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'Check the list of application profiles if the Apache Full profile does not exist:
sudo ufw app listYou can also open the two web ports directly:
sudo ufw allow 80/tcp
sudo ufw allow 443/tcpCheck the status again:
sudo ufw statusIf you previously allowed an HTTP-only profile, you can remove the old rule after confirming Apache Full activity:
sudo ufw delete allow 'Apache'Step 4 — Issue and install a TLS certificate
Run Certbot with the Apache plugin and specify all domains that need protection:
sudo certbot --apache -d your_domain -d www.your_domainCertbot will ask for an email address to send security notifications and renewal reminders, and will also ask you to accept the terms of service. Enter an active email address and answer the interactive questions as needed.
Certbot will usually ask whether you want to redirect all HTTP traffic to HTTPS. For a public website, choosing the redirect option is generally appropriate, as long as the application does not need to keep HTTP available separately.
After completion, the certificate files are typically located at:
/etc/letsencrypt/live/your_domain/fullchain.pem
/etc/letsencrypt/live/your_domain/privkey.pemfullchain.pem contains the server certificate and the intermediate certificate chain; privkey.pem is the private key. Do not share or grant read access to the private key to unnecessary users (according to the Ubuntu Server documentation).
Certbot will also create or update the HTTPS configuration for Apache, usually with a -le-ssl.confsuffix, and then reload the service. Open the website using https:// to confirm that the browser receives a valid certificate.
You can use SSL Labs Server Test to check the certificate and TLS configuration through an external service.
Step 5 — Check Certbot automatic renewal
Let’s Encrypt certificates are currently valid for 90 days and are designed to be renewed automatically on a regular basis (according to the Ubuntu Server documentation). Do not wait until the expiration date is near to renew them manually.
The Certbot version installed from Snap sets up a systemd timer to attempt renewal twice a day. Check the timer with the command:
sudo systemctl status snap.certbot.renew.timerIf the timer is not running, you can enable and start it:
sudo systemctl enable --now snap.certbot.renew.timerRun a test of the renewal process without changing the certificate currently in use:
sudo certbot renew --dry-runIf the result indicates that the simulated renewal attempts were successful, the configuration is ready. When necessary, Certbot will renew the certificate, and the Apache plugin will reload Apache after a successful renewal. If the website is behind a network firewall, load balancer, or cloud provider, make sure that ports 80 and 443 are also allowed at that network layer.
Conclusion
You have installed Certbot, checked the Apache VirtualHost, opened the necessary web ports, issued a Let’s Encrypt TLS certificate, and verified the automatic renewal mechanism. After enabling HTTPS, check both the primary domain and the domain www, and monitor Let’s Encrypt warning emails so that renewal errors can be addressed promptly.
References
