0Pricing
Linux Server Deployment & SSH Mastery · Lesson

Enabling HTTPS with Let's Encrypt

Secure your web server with free TLS certificates from Let's Encrypt. Install Certbot, obtain and auto-renew certificates, and configure Nginx or Apache to serve traffic over HTTPS with HTTP redirects.

Enabling HTTPS with Let's Encrypt is a free Linux Server Deployment & SSH Mastery lesson on CoddyKit — lesson 4 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Linux Server Deployment & SSH Mastery learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Why HTTPS Is Non-Negotiable

You can host sites and configure virtual hosts — but serving them over plain HTTP exposes traffic to eavesdropping and tampering. Browsers now flag HTTP sites as 'Not Secure'.

HTTPS encrypts traffic using a TLS certificate. Thanks to Let's Encrypt, these certificates are free and automated.

How Let's Encrypt Works

Let's Encrypt is a certificate authority that issues short-lived (90-day) certificates for free. To prove you control a domain, it uses the ACME protocol with an automated challenge.

A client called Certbot handles requesting, installing, and renewing certificates for you.

Prerequisites

Before requesting a certificate, make sure:

  • Your domain's DNS A record points to the server's IP
  • Ports 80 and 443 are open in the firewall
  • Your web server is running and serving the domain

The challenge needs port 80 reachable from the internet.

sudo ufw allow 'Nginx Full'
dig +short yourdomain.com

Installing Certbot

Certbot is available as a package, with plugins for Nginx and Apache that automate config changes.

sudo apt install certbot python3-certbot-nginx
# For Apache:
sudo apt install certbot python3-certbot-apache

Obtaining a Certificate (Nginx)

The Nginx plugin obtains the certificate and edits your server block to use it. Pass your domain(s) with -d.

Certbot detects the matching server block automatically.

sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com

Obtaining a Certificate (Apache)

For Apache the workflow is identical with the apache plugin. Certbot updates your virtual host to enable SSL.

sudo certbot --apache -d yourdomain.com

Forcing HTTPS Redirects

During setup Certbot asks whether to redirect HTTP to HTTPS — choose yes. If you skipped it, add a redirect manually in the HTTP server block.

server {
    listen 80;
    server_name yourdomain.com;
    return 301 https://$host$request_uri;
}

Automatic Renewal

Certificates expire after 90 days, but Certbot installs a systemd timer (or cron job) that renews them automatically. You can test the renewal process safely with a dry run.

sudo certbot renew --dry-run
systemctl list-timers | grep certbot

Verifying Your Certificate

Confirm HTTPS works by visiting the site and inspecting the certificate. From the CLI you can list managed certs and check expiry.

sudo certbot certificates
curl -svI https://yourdomain.com 2>&1 | grep -i 'subject\|expire'

Strengthening TLS

For top security, tune your TLS config: disable old protocols, prefer strong ciphers, and enable HSTS so browsers always use HTTPS.

Tools like Mozilla's SSL Configuration Generator produce ready-to-paste settings.

ssl_protocols TLSv1.2 TLSv1.3;
add_header Strict-Transport-Security 'max-age=63072000' always;

Best Practices

Run HTTPS reliably:

  • Always redirect HTTP to HTTPS
  • Test renewal with --dry-run after setup
  • Open both 80 and 443; 80 is needed for renewals
  • Enable HSTS and modern TLS protocols only

Quick Check

Test your HTTPS knowledge.

Recap

You secured your web server with free TLS:

  • Installed Certbot with the Nginx/Apache plugin
  • Obtained certificates with certbot --nginx -d
  • Forced HTTP → HTTPS redirects
  • Confirmed automatic renewal with a dry run

Your static sites and virtual hosts now serve encrypted traffic by default.

Frequently asked questions

Is the “Enabling HTTPS with Let's Encrypt” lesson free?

Yes — the full text of “Enabling HTTPS with Let's Encrypt” is free to read here on the web, and the Linux Server Deployment & SSH Mastery course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Linux Server Deployment & SSH Mastery course, upgrade to CoddyKit PRO.

What will I learn in “Enabling HTTPS with Let's Encrypt”?

Secure your web server with free TLS certificates from Let's Encrypt. Install Certbot, obtain and auto-renew certificates, and configure Nginx or Apache to serve traffic over HTTPS with HTTP redirect… You practise Linux Server Deployment & SSH Mastery with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Linux Server Deployment & SSH Mastery?

No prior experience is required. Linux Server Deployment & SSH Mastery on CoddyKit is structured for beginners through advanced learners; this is — lesson 4 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Enabling HTTPS with Let's Encrypt” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Linux Server Deployment & SSH Mastery lesson?

Yes. Every Linux Server Deployment & SSH Mastery lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. Installing Nginx/Apache
  2. Hosting Static Websites
  3. Basic Virtual Host Configuration
  4. Enabling HTTPS with Let's Encrypt
← Back to Linux Server Deployment & SSH Mastery