How to Generate a Free SSL Certificate Using Let’s Encrypt in 2025

Securing your website with SSL is essential for protecting data and building user trust. Let’s Encrypt is a free, automated, and open Certificate Authority (CA) that makes it easy to obtain SSL certificates. With Let’s Encrypt, you can encrypt your website traffic without incurring costs or navigating complex processes. This guide walks you through the steps to generate and install a free SSL certificate using Let’s Encrypt, ensuring your website is secure and compliant with modern web standards. Follow these detailed instructions to get started!

Here’s a step-by-step guide to generate a free SSL certificate using Let’s Encrypt:

---

Step 1: Install Certbot

Certbot is the official tool for generating and managing Let’s Encrypt SSL certificates. Follow these steps to install it:

On Ubuntu/Debian:

bash

sudo apt update
sudo apt install certbot python3-certbot-nginx

On CentOS/RHEL:

bash

sudo yum install epel-release
sudo yum install certbot python3-certbot-nginx

On macOS:

bash

brew install certbot

---

Step 2: Prepare Your Server

1. Ensure your domain points to your server’s IP address using DNS records.
2. Open port 80 (HTTP) and 443 (HTTPS) in your firewall:

bash

sudo ufw allow 80
sudo ufw allow 443

---

Step 3: Generate SSL Certificate

For Nginx:

1. Run Certbot with the Nginx plugin: sudo certbot --nginx
2. Follow the prompts:
   • Enter your email address.
   • Agree to the terms of service.
   • Select the domain(s) you want to secure.
3. Certbot will automatically configure Nginx to use the SSL certificate.

For Apache:

1. Run Certbot with the Apache plugin: sudo certbot --apache
2. Follow the prompts as above, and Certbot will configure Apache automatically.

For Manual Installation:

1. Run Certbot in standalone mode: sudo certbot certonly --standalone
2. Follow the prompts to generate the certificate.
3. The certificate files will be saved in /etc/letsencrypt/live/yourdomain.com/:
   • Certificate: fullchain.pem
   • Private Key: privkey.pem
4. Configure your web server (Nginx/Apache) manually to use these files.

---

Step 4: Test SSL Configuration

1. Restart your web server:
   • Nginx: sudo systemctl restart nginx
   • Apache: sudo systemctl restart apache2
2. Visit your website using https:// to verify SSL is working.
3. Use SSL Labs to check your SSL setup.

---

Step 5: Automate Renewal

Let’s Encrypt certificates are valid for 90 days. Automate renewal using a cron job:

1. Test renewal manually: sudo certbot renew --dry-run
2. If successful, Certbot’s installation usually sets up a cron job for automatic renewal. Verify it: sudo systemctl list-timers | grep certbot
3. Alternatively, add this command to your cron jobs: 0 0,12 * * * /usr/bin/certbot renew --quiet

---

Step 6: Troubleshooting

• Firewall Issues: Ensure ports 80 and 443 are open.
• DNS Propagation: Verify your domain resolves to your server using ping yourdomain.com.

About The Author