Apache HTTPS with Let’s Encrypt on Ubuntu

Introduction

Let’s Encrypt is a free, automated Certificate Authority (CA) that issues TLS certificates to authenticate servers and encrypt connections between browsers and web servers. Certbot is an ACME client used to request, install, and automatically renew certificates. With the Apache plugin, Certbot can identify the appropriate VirtualHost, add the TLS configuration, and reload Apache after installation (according to ubuntu.com).

In this guide, you will use Certbot to obtain a certificate for Apache on Ubuntu 22.04 or Ubuntu 24.04, enable HTTPS, and verify automatic renewal.

This article uses a separate VirtualHost file for the website rather than modifying Apache’s default configuration. This approach gives each domain an independent configuration and makes the server easier to manage when it hosts multiple websites.

Prerequisites

To follow this guide, you need:

An Ubuntu 22.04 or Ubuntu 24.04 server with a non- rootuser, administrative access through sudo , and a configured firewall. You can refer to the Ubuntu server setup guide.
A registered domain. In this article, the example domain is your_domain.
The domain’s DNS records must point to the server’s public IP address. If you want one certificate to cover both names, create:
- An A or AAAA record for your_domain, depending on the type of address used by the server.
- An A or AAAA record for www.your_domain, if the website uses this name.
Apache installed with a VirtualHost for the domain, such as /etc/apache2/sites-available/your_domain.conf. See also how to install Apache on Ubuntu.
TCP port 80 must be reachable from the Internet when using the HTTP-01 challenge; TCP port 443 must be open so users can access HTTPS (according to the Ubuntu Server documentation).

Step 1 — Install Certbot

Current Ubuntu documentation recommends installing Certbot from the Snap Store. This keeps Certbot updated independently of Ubuntu’s APT package release cycle.

If Snap is not yet installed on the server, install snapdit:

sudo apt update
sudo apt install snapd

Then install Certbot:

sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot

If the command certbot is not found after installation, create a link to the executable:

sudo ln -s /snap/bin/certbot /usr/bin/certbot

If the server already has Certbot installed through APT, check the existing package before switching to Snap. Avoid installing two Certbot versions at the same time unless you are sure they use the same renewal mechanism. You can list related packages with:

apt list --installed 2>/dev/null | grep -E 'certbot|python3-certbot'

Check the installed version:

certbot --version

Step 2 — Check Apache VirtualHost Configuration

To automatically obtain and install a certificate, Certbot must find the correct VirtualHost in the Apache configuration. The domain name is taken from the ServerName and ServerAlias. The VirtualHost in use should be enabled in the /etc/apache2/sites-enabled/block.

Open the domain’s VirtualHost file:

sudo nano /etc/apache2/sites-available/your_domain.conf

Make sure the file contains similar lines:

<VirtualHost *:80>
    ServerName your_domain
    ServerAlias www.your_domain
    DocumentRoot /var/www/your_domain
</VirtualHost>

If the website is not enabled, enable the VirtualHost and then check the syntax:

sudo a2ensite your_domain.conf
sudo apache2ctl configtest

The expected result is Syntax OK. If there are no errors, reload Apache and display the VirtualHost list:

sudo systemctl reload apache2
sudo apache2ctl -S

Step 3 — Open HTTP and HTTPS on the Firewall

If you use UFW, allow SSH, HTTP, and HTTPS. Do not close port 80 before completing certificate issuance, because the HTTP-01 challenge verifies control of the domain by sending an HTTP request to the server through this port (according to ubuntu.com).

sudo ufw status
sudo ufw allow OpenSSH
sudo ufw allow 'Apache Full'

If the profile Apache Full does not exist, list the available profiles or open the two web ports directly:

sudo ufw app list
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw status

If you previously allowed a profile intended only for HTTP, you can remove the old rule after confirming that the HTTPS rule works:

sudo ufw delete allow 'Apache'

In addition to UFW, check the firewall provided by your VPS provider, as well as any security group, router, or load balancer. These network layers must also allow incoming traffic on ports 80 and 443.

Step 4 — Issue and install a TLS certificate

Run Certbot with the Apache plugin and specify all domains that need protection:

sudo certbot --apache -d your_domain -d www.your_domain

Certbot will request an email address for alerts, ask you to accept the Terms of Service, and ask whether you want to redirect HTTP to HTTPS. For a public website, redirecting all HTTP traffic to HTTPS is generally appropriate, provided the application does not need to keep HTTP available separately.

Each -d option adds a domain name to the certificate as a Subject Alternative Name (SAN). Therefore, list every domain the certificate must cover in the same command.

After completion, the certificate files are typically located at:

/etc/letsencrypt/live/your_domain/fullchain.pem
/etc/letsencrypt/live/your_domain/privkey.pem

fullchain.pem contains the server certificate and the intermediate certificate chain; privkey.pem is the private key. Do not share the private key or grant read access to users who do not need it. Certbot typically uses paths under the live directory to configure the service.

Certbot will create or update Apache’s HTTPS configuration and then reload the service. Open both https://your_domain and https://www.your_domain to confirm the correct domains, certificate, and redirect settings.

You can use SSL Labs Server Test to check the certificate and TLS configuration through an external service.

Step 5 — Check Certbot automatic renewal

Let’s Encrypt certificates issued under the current default profile still have a 90-day validity period. Let’s Encrypt is rolling out shorter-lived profiles: the tlsserver profile may issue 45-day certificates from May 13, 2026, while the default classic profile is expected to move to 64 days on February 10, 2027, and to 45 days on February 16, 2028. Most users with automatic renewal will not need to make immediate changes, but they should ensure that the renewal schedule does not rely on an excessively long fixed interval (according to Let’s Encrypt.

The Certbot version installed from Snap sets up a systemd timer to attempt renewal twice a day. Check the timer with the command:

sudo systemctl status snap.certbot.renew.timer

Run a test of the renewal process without changing the certificate currently in use:

sudo certbot renew --dry-run

If the result reports that the simulated renewal succeeded, the basic configuration is ready. When the certificate approaches expiration, Certbot will renew it automatically; for certificates installed through the Apache plugin, Apache is reloaded after a successful renewal (according to ubuntu.com).

If the website uses a reverse proxy, load balancer, or network firewall, check its reachability from the Internet and review the logs when the command --dry-run fails. For domains that cannot serve HTTP-01 over port 80, or when a wildcard certificate such as *.example.comis required, you can use the DNS-01 challenge with the corresponding DNS plugin.

Conclusion

You have installed Certbot, checked the Apache VirtualHost, opened the necessary web ports, issued a Let’s Encrypt TLS certificate, and verified the automatic renewal mechanism. After enabling HTTPS, check both the primary domain and the domain www, monitor renewal logs, and address any warnings promptly to prevent the certificate from expiring.

Configure HTTPS for Apache with Let’s Encrypt on Ubuntu