# How to Use Certbot With Nginx to Request and Renew a Free SSL Certificate
A site can have working HTTP content and still leave an important job unfinished: serving that content over HTTPS. The original workflow for this post uses Certbot with the Nginx plugin to request a free certificate, apply it to an Nginx site, and renew it automatically. It is intended for someone who can connect to a server through SSH and run commands with `sudo` privileges.
This guide restates that workflow in clear English and separates the two choices that matter most: allowing Certbot to edit Nginx for you, or requesting the certificate first and making the Nginx changes yourself. It also covers the source post’s renewal and account-email steps.
> **Recency and risk note:** The source procedure installs Certbot in a Python virtual environment under `/opt/certbot` and uses `pip`. Package names, Certbot installation guidance, Nginx plugin behavior, and renewal scheduling can change over time. Treat the commands below as a source-based reference, back up your Nginx configuration, and verify the current instructions for your operating system and web server before using them on a production host.
## Before you start
You need SSH access to the server that runs the HTTP version of your website. Run the commands as a user with `sudo` permissions. Because the Nginx option is used in the source material, this process also assumes Nginx is the web server you want Certbot to work with.
There are two practical decisions to make before requesting the certificate:
1. **Do you want Certbot to update Nginx automatically?** If so, use the Nginx installation command later in this guide.
2. **Do you prefer to edit the Nginx HTTPS configuration yourself?** If so, request the certificate only, then make the configuration changes manually.
The original post also warns against mixing installation methods. If Certbot was installed from your operating system’s package manager, remove that package before installing the virtual-environment version. The purpose is to avoid invoking an operating-system Certbot package when you expect to use the version installed in `/opt/certbot`.
## Install the required system dependencies
Start by installing the dependencies appropriate for your Linux distribution.
For Debian-based distributions, including Debian and Ubuntu, the source provides:
“`bash
sudo apt update
sudo apt install python3 python3-venv libaugeas0
“`
For RPM-based distributions, including Fedora and CentOS, it provides:
“`bash
sudo dnf install python3 augeas-libs
“`
The package manager is part of the instruction. Use the Debian-style commands only on a Debian-based host, and use the RPM-style command only on an applicable RPM-based host.
## Remove a package-manager Certbot installation if necessary
The source specifically advises removing any Certbot package installed with `apt`, `dnf`, or `yum` before continuing with the virtual-environment installation. Common examples listed in the original instructions are:
“`bash
sudo apt-get remove certbot
sudo dnf remove certbot
sudo yum remove certbot
“`
You would use the command that matches the package manager on your server, not all three commands. This step is about preventing command-path confusion. If multiple Certbot installations exist, the `certbot` command you run may not be the one you intended to install or update.
## Create the Certbot Python virtual environment
The source workflow places Certbot in `/opt/certbot`. Create the virtual environment and upgrade `pip` inside it:
“`bash
sudo python3 -m venv /opt/certbot/
sudo /opt/certbot/bin/pip install –upgrade pip
“`
A virtual environment keeps the Certbot installation located in its own directory rather than relying on a system-wide Python package installation. In this particular workflow, later commands reference `/opt/certbot/bin/` for that reason.
## Install Certbot and the Nginx plugin
Install both Certbot and its Nginx plugin with:
“`bash
sudo /opt/certbot/bin/pip install certbot certbot-nginx
“`
The Nginx plugin is what supports the automatic Nginx route described later. At this stage, the key point is that Certbot is installed within the virtual environment, not through `apt`, `dnf`, or `yum`.
## Make the Certbot command available
The original post next creates a symbolic link so the `certbot` command can be called more conveniently. Its intended paths are the Certbot binary in `/opt/certbot/bin/` and `/usr/bin/certbot`:
“`bash
sudo ln -s /opt/certbot/bin/certbot /usr/bin/certbot
“`
Check command paths carefully before creating or replacing a link on a server. This is especially important if a prior package-manager installation existed, because the earlier removal step and this link serve the same goal: making sure the command you invoke resolves to the expected Certbot installation.
## Choose how to request the certificate
Certbot offers two paths in the source post. Select the one that matches the level of control you want over Nginx.
### Option 1: Request the certificate and let Certbot configure Nginx
Use this command when you want Certbot to obtain the certificate, edit the Nginx configuration to use it, and enable HTTPS in one operation:
“`bash
sudo certbot –nginx
“`
This is the streamlined option. It combines certificate issuance and Nginx configuration work, which can be useful when you want Certbot to handle the HTTPS setup rather than manually editing server blocks.
### Option 2: Request the certificate only
Use this command if you want to make Nginx configuration changes yourself:
“`bash
sudo certbot certonly –nginx
“`
This is the more conservative path described by the source. It obtains the certificate without relying on Certbot to make the Nginx HTTPS changes for you. Afterward, you are responsible for configuring Nginx to use the certificate.
The difference is simple but important: `certbot –nginx` is the automatic Nginx setup route, while `certbot certonly –nginx` is the certificate-only route. Do not assume that requesting a certificate alone finishes the HTTPS configuration; the source distinguishes that choice precisely because manual Nginx work may still be required.
## Set up automatic renewal
Certificates need renewal. The source recommends adding a cron entry that runs twice daily, at midnight and noon, and includes a randomized delay before running a quiet renewal command:
“`bash
echo “0 0,12 * * * root /opt/certbot/bin/python -c ‘import random; import time; time.sleep(random.random() * 3600)’ && sudo certbot renew -q” | sudo tee -a /etc/crontab > /dev/null
“`
This entry appends a job to the default crontab. It calls Python from the `/opt/certbot` environment, waits for a random interval of up to an hour, and then runs `certbot renew -q`. The quiet flag reduces normal command output.
Because this command modifies `/etc/crontab`, review it before running it. Confirm that the path to your Certbot environment is correct and that your server’s cron configuration is the place you intend to manage renewal. A production server should have a renewal method you can identify, monitor, and revisit when its Certbot installation changes.
## Verify that HTTPS is working
After Certbot has completed the requested work, visit your site in a browser using its HTTPS address:
“`text
https://yourwebsite.com/
“`
The source suggests looking for the lock icon in the browser address bar. That is a straightforward browser-level check that the site is being accessed through HTTPS. It does not replace reviewing your server configuration, but it is a useful first confirmation after certificate installation or Nginx changes.
## Upgrade Certbot when needed
To upgrade the virtual-environment installation, the source gives this command:
“`bash
sudo /opt/certbot/bin/pip install –upgrade certbot certbot-nginx
“`
If that upgrade produces an error, the original procedure says to remove `/opt/certbot` and repeat the installation steps:
“`bash
sudo rm -rf /opt/certbot
“`
That is a destructive removal command. Do not run it casually. It deletes the directory holding the virtual-environment installation, so use it only when you understand the recovery path and are prepared to reinstall Certbot as described above.
## Update the certificate account email
If you later need to change the email address associated with certificate expiration notifications, the source provides:
“`bash
certbot update_account –email yourname@example.com
“`
Replace the example address with the address you want to receive notifications. Keeping that contact address current helps ensure that certificate-related messages go to someone who can act on them.
## Final checklist
For this source-based Certbot and Nginx workflow, the essential sequence is: install the right dependencies, avoid conflicting Certbot installations, create the `/opt/certbot` virtual environment, install Certbot and `certbot-nginx`, choose automatic or certificate-only Nginx handling, configure renewal, and confirm the HTTPS site in a browser. Before treating the setup as complete, verify current Certbot guidance for your operating system and keep a record of how renewal is scheduled on the server.
