How to Get Free SSL Certificates Automatically with Certbot

SSH into your server as a user with sudo privileges, where your HTTP website runs. Install the system dependencies:

For Debian-based distributions (such as Debian, Ubuntu …):

$ sudo apt update
$ sudo apt install python3 python3-venv libaugeas0 

For RPM-based distributions (such as Fedora, CentOS …):

$ sudo dnf install python3 augeas-libs 

If you installed any certbot packages with your OS package manager — apt, dnf, or yum — remove them before installing the certbot snap, to ensure that certbot uses the snap when you run commands rather than the installation from your OS package manager. The exact commands depend on your operating system, but common examples are sudo apt-get remove certbot, sudo dnf remove certbot, or sudo yum remove certbot. Set up a Python virtual environment:

Run the following instructions on your machine's command line to set up the virtual environment.

$ sudo python3 -m venv /opt/certbot/
$ sudo /opt/certbot/bin/pip install -upgrade pip 

Installing certbot

Run this command on your machine's command line to install CERTBOT:

$ sudo /opt/certbot/bin/pip install certbot certbot-nginx 

Preparing the certbot command

Run the following on your machine's command line to make sure the certbot command works.

$ sudo ln -s/opt/certbot/bin/certbot/usr/bin/certbot 

Choose how you would like to run certbot:

Either get and install your certificate…

Run this command to get a certificate and let Certbot automatically edit your NGINX configuration to use it, enabling HTTPS access in one step.

$ sudo certbot -nginx 

Or, just get a certificate

If you are more conservative and prefer to make changes to the NGINX configuration manually, run this command.

$ sudo certbot certonly -nginx 

Set up automatic renewal

We recommend running the following line, which adds a CRON job to the default crontab.

$ echo "0 0,12 * * * root /opt/certbot/bin/python -c 'import random; import time; time.sleep(random.random() * 3600)' && sudo certbot renew -q" | sudo tee -a /etc/crontab > /dev/null

Confirm Certbot works

To confirm your website is set up correctly, visit https://yourwebsite.com/ in your browser and look for the lock icon in the URL bar.

Upgrade CERTBOT

$ sudo /opt/certbot/bin/pip install --upgrade certbot certbot-nginx

If this step causes an error, run sudo rm -rf /opt/certbot and repeat all the installation instructions.

If you later want to change the email address used for domain expiry reminders, you can use the following command:

$ certbot update_account --email yourname@example.com

Source: https://certbot.eff.org/instructions?ws=nginx&os=pip